SQL Injection Vulnerability in Budibase Low-Code Platform

CVE-2026-73408

What is CVE-2026-73408?

Budibase, an open-source low-code platform, contains a vulnerability related to SQL injection prior to version 3.39.18. The flaw exists in the MySQL integration, specifically in the handling of unescaped table names within a DESCRIBE statement. If an attacker creates a MySQL table with a backtick and includes a stacked statement in its name, they can exploit this vulnerability when a Budibase administrator performs schema discovery. This allows the malicious statement to be executed inadvertently. The issue has been addressed in version 3.39.18 with the implementation of quoteMySqlIdentifier before query construction, enhancing security against such attacks.

References