PT-2026-44060 · Budibase · Budibase

Adrgs · Published 2026-05-27 · Updated 2026-05-27 · CVE-2026-48149

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Budibase versions prior to 3.39.0

Description The Text component in this open-source low-code platform renders markdown by assigning the output of the marked.parse(markdown) function directly to innerHTML without using a sanitizer. This creates a stored Cross-Site Scripting (XSS) sink, where XSS is a flaw that allows an attacker to inject malicious scripts into web pages viewed by other users. Any column bound to a Text component in Markdown mode can be exploited by any basic application user who has write permissions on the underlying table.

Recommendations Update to version 3.39.0.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-48149

Affected Products

Budibase

References · 4

• 🔥 https://github.com/Budibase/budibase/security/advisories/GHSA-57p7-9h9w-xqpw · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-48149 · Security Note
• https://twitter.com/CVEnew/status/2059718141752836243 · Twitter Post
• https://twitter.com/infoflowcloud/status/2059719115619647637 · Twitter Post