Cross-Site Scripting Vulnerability in Budibase Low-Code Platform

CVE-2026-35218

What is CVE-2026-35218?

Budibase, an open-source low-code platform, contains a security vulnerability prior to version 3.32.5, where its Builder Command Palette fails to properly sanitize entity names—including tables, views, queries, and automations. This flaw allows authenticated users with Builder access to craft entity names that incorporate malicious HTML payloads. When another user in the same workspace opens the Command Palette, the payload can execute in their browser, facilitating session cookie theft and leading to complete account takeover. The issue has been addressed in version 3.32.5.

References