CVE-2026-27702

Budibase is a low code platform for creating internal tools, workflows, and admin panels. Prior to version 3.30.4, an unsafe `eval()` vulnerability in Budibase's view filtering implementation allows any authenticated user (including free tier accounts) to execute arbitrary JavaScript code on the server. This vulnerability ONLY affects Budibase Cloud (SaaS) - self-hosted deployments use native CouchDB views and are not vulnerable. The vulnerability exists in `packages/server/src/db/inMemoryView.ts` where user-controlled view map functions are directly evaluated without sanitization. The primary impact comes from what lives inside the pod's environment: the `app-service` pod runs with secrets baked into its environment variables, including `INTERNAL_API_KEY`, `JWT_SECRET`, CouchDB admin credentials, AWS keys, and more. Using the extracted CouchDB credentials, we verified direct database access, enumerated all tenant databases, and confirmed that user records (email addresses) are readable. Version 3.30.4 contains a patch.

• CWE-20
• CWE-94
• CWE-95
• CWE-94

• https://github.com/Budibase/budibase/commit/348659810cf930dda5f669e782706594c547115dPatch
• https://github.com/Budibase/budibase/pull/18087Issue Tracking
• https://github.com/Budibase/budibase/releases/tag/3.30.4Release Notes
• https://github.com/Budibase/budibase/security/advisories/GHSA-rvhr-26g4-p2r8Exploit, Vendor Advisory

Published

Feb 25, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-27696changedetection.io is a free open source web page change det…8.6
• CVE-2026-27697baserCMS is a website development framework. Prior to versio…9.8
• CVE-2026-27699The `basic-ftp` FTP client library for Node.js contains a pa…9.8
• CVE-2026-2770Use-after-free in the DOM: Bindings (WebIDL) component. This…9.8
• CVE-2026-27700Hono is a Web application framework that provides support fo…7.5
• CVE-2026-27701LiveCode is an open-source, client-side code playground. Pri…8.8
• CVE-2026-27703RIOT is an open-source microcontroller operating system, des…9.8
• CVE-2026-27704The Dart and Flutter SDKs provide software development kits …7.5
• CVE-2026-27705Plane is an an open-source project management tool. Prior to…6.5
• CVE-2026-27706Plane is an an open-source project management tool. Prior to…7.7
• CVE-2026-27707Seerr is an open-source media request and discovery manager …9.8
• CVE-2026-27708FOSSBilling is a free, open-source billing and client manage…7.1