CVE-2026-25044
Last modified
CVE-2026-25044 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. Budibase is an open-source low-code platform. Prior to version 3.33.4, the bash automation step executes user-provided commands using execSync without proper sanitization or validation. EPSS estimates a 0.47% chance of exploitation in the next 30 days.
Description
Budibase is an open-source low-code platform. Prior to version 3.33.4, the bash automation step executes user-provided commands using execSync without proper sanitization or validation. User input is processed through processStringSync which allows template interpolation, potentially allowing arbitrary command execution. This issue has been patched in version 3.33.4.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Budibase | Budibase | < 3.33.4 |
References
- https://github.com/Budibase/budibase/releases/tag/3.33.2Product, Release Notes
- https://github.com/Budibase/budibase/security/advisories/GHSA-gjw9-34gf-rp6mMitigation, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-25044?
How severe is CVE-2026-25044?
How do I fix CVE-2026-25044?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-25038Gitea 1.26.2 allows unauthorized users to access labels of p…7.5
- CVE-2026-25039Parsec is a cloud-based application for simple and cryptogra…8.8
- CVE-2026-2504The Dealia – Request a quote plugin for WordPress is vulnera…4.3
- CVE-2026-25040Budibase is a low code platform for creating internal tools,…8.8
- CVE-2026-25041Budibase is a low code platform for creating internal tools,…7.2
- CVE-2026-25043Budibase is an open-source low-code platform. Prior to versi…7.5
- CVE-2026-25045Budibase is a low code platform for creating internal tools,…8.8
- CVE-2026-25046Kimi Agent SDK is a set of libraries that expose the Kimi Co…2.9
- CVE-2026-25047deepHas provides a test for the existence of a nested object…8.8
- CVE-2026-25048xgrammar is an open-source library for efficient, flexible, …7.5
- CVE-2026-25049n8n is an open source workflow automation platform. Prior to…9.9
- CVE-2026-2505The Categories Images plugin for WordPress is vulnerable to …5.4
Are you affected by CVE-2026-25044?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST