CVE-2026-35218

Budibase is an open-source low-code platform. Prior to version 3.32.5, Budibase's Builder Command Palette renders entity names (tables, views, queries, automations) using Svelte's {@html} directive without any sanitization. An authenticated user with Builder access can create a table, automation, view, or query whose name contains an HTML payload (e.g. <img src=x onerror=alert(document.domain)>). When any Builder-role user in the same workspace opens the Command Palette (Ctrl+K), the payload executes in their browser, stealing their session cookie and enabling full account takeover. This issue has been patched in version 3.32.5.

• CWE-79

• https://github.com/Budibase/budibase/commit/c9ccf0c19e5849f1bda96401aa33f97c99cd8cd6Patch
• https://github.com/Budibase/budibase/pull/18243Issue Tracking, Patch
• https://github.com/Budibase/budibase/releases/tag/3.32.5Product, Release Notes
• https://github.com/Budibase/budibase/security/advisories/GHSA-gp5x-2v54-v2q5Exploit, Vendor Advisory

Published

Apr 3, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-35212OpenCTI is an open source platform for managing cyber threat…6.1
• CVE-2026-35213@hapi/content provided HTTP Content-* headers parsing. All v…7.5
• CVE-2026-35214Budibase is an open-source low-code platform. Prior to versi…8.7
• CVE-2026-35215Firebird is an open-source relational database management sy…7.5
• CVE-2026-35216Budibase is an open-source low-code platform. Prior to versi…9
• CVE-2026-35217NanoMQ contains a protocol-semantics flaw in its MQTT v5 `SU…6.5
• CVE-2026-35220Lack of CSRF token validation lead to a CSRF attack vector i…4.3
• CVE-2026-35221Improperly built filter clauses lead to a SQL injection vuln…9.8
• CVE-2026-35222Improperly validated order clauses lead to a SQL injection v…9.8
• CVE-2026-35223An improper access check allows unauthorized access to com_c…9.8
• CVE-2026-35225An unauthenticated remote attacker is able to exhaust all av…8.7
• CVE-2026-35226An out‑of‑bounds write vulnerability in the CODESYS PROFINET…7.1