Cross-Site Scripting Vulnerability in Budibase Low-Code Platform
CVE-2026-42239

8.1HIGH

Key Information:

Vendor

Budibase

Status
Budibase
Vendor
CVE Published:
7 May 2026

What is CVE-2026-42239?

The Budibase low-code platform suffers from a significant security oversight where the 'budibase:auth' cookie, which contains a JWT session token, is marked with httpOnly: false. This flaw allows attackers to exploit Cross-Site Scripting (XSS) vulnerabilities to access the cookie via JavaScript, potentially leading to full account takeover. Furthermore, this cookie does not have the secure flag set, meaning it is transmitted over HTTP, exposing it to interception. The absence of the sameSite attribute exacerbates this risk. This vulnerability was resolved in version 3.35.10, urging users to upgrade promptly to maintain secure application environments.

Affected Version(s)

budibase < 3.35.10

References

https://github.com/Budibase/budibase/security/advisories/...
x_refsource_CONFIRM
https://github.com/Budibase/budibase/releases/tag/3.35.10
x_refsource_MISC

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.