Remote Code Execution in Budibase Plugin Handling
CVE-2026-82244

9.4CRITICAL

Key Information:

Vendor

Budibase

Status
Server
Vendor
CVE Published:
28 August 2026

What is CVE-2026-82244?

Budibase versions prior to 3.41.3 are susceptible to a remote code execution vulnerability stemming from insecure plugin handling. This flaw allows authenticated admin users to upload malicious plugin tarballs, which the server processes using the eval() function on the JavaScript files without proper sandboxing in the primary Node.js environment. As a result, attackers can execute arbitrary code and potentially gain access to sensitive environment variables and credentials with root privileges, particularly in default deployments.

Affected Version(s)

server 0 < 3.41.3

server 3.41.3

References

https://github.com/Budibase/budibase/security/advisories/...
vendor-advisory
https://www.vulncheck.com/advisories/budibase-before-3.41...
third-party-advisory

CVSS V4

Score:
9.4
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Vasco0x4
.