Description

Budibase is an open-source low-code platform. Prior to 3.39.19, the PostgreSQL datasource connector in packages/server/src/integrations/postgres.ts interpolates the user-controlled schema configuration field into a SET search_path statement without escaping embedded double quotes, allowing an authenticated administrator who saves or tests the datasource to execute arbitrary SQL through the simple query protocol. This issue is fixed in version 3.39.19.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.4",
  "pubDate": "2026-08-17T21:16:46.340Z",
  "pubdate": "2026-08-17T21:16:46.340Z",
  "executiveSummary": "An SQL injection vulnerability exists within the PostgreSQL datasource connector of Budibase prior to version 3.39.19. The vulnerability arises due to improper neutralization of user-supplied input within database configuration fields. Specifically, the schema configuration field located in packages/server/src/integrations/postgres.ts directly interpolates user-controlled input into a SQL SET search_path statement without correctly escaping embedded double quotes.\nThis flaw allows an authenticated administrator who possesses the capability to save or test the datasource to execute arbitrary SQL commands against the underlying database via the simple query protocol. The impact of successful exploitation includes full database compromise, unauthorized data exfiltration, modification, or deletion, depending on the privileges of the database user executing the queries. The risk implications are severe for environments where administrative accounts may be compromised or untrusted administrators are provisioned.\nExploitation requires administrative authentication within the Budibase platform and the ability to configure or test a PostgreSQL datasource connector. Remediation requires updating Budibase to version 3.39.19 or later, where proper escaping mechanisms are implemented to neutralize the injection vector.",
  "technicalDetails": "The vulnerability resides in the PostgreSQL integration module of Budibase, specifically within the source file packages/server/src/integrations/postgres.ts. The root cause of the vulnerability is the unsafe string interpolation of the user-controlled schema configuration parameter directly into a dynamic SQL statement. When a datasource is saved or tested, the application executes a SET search_path statement to configure the database search path, incorporating the raw schema input string without sanitizing or escaping embedded double quote characters.\nBecause the input is processed via the PostgreSQL simple query protocol, an attacker who has authenticated as an administrator can inject arbitrary SQL commands by terminating the expected string context using double quotes and appending malicious SQL syntax. The attack flow proceeds as follows: First, the attacker authenticates to the Budibase platform with administrative privileges. Second, the attacker navigates to the PostgreSQL datasource configuration interface. Third, the attacker inputs a specially crafted payload containing SQL commands into the schema configuration field. Fourth, upon triggering the save or test datasource action, Budibase constructs the vulnerable SET search_path query using the unescaped payload. Finally, the database server parses and executes the injected SQL statements alongside the intended command.\nThe vulnerable component is the PostgreSQL datasource connector handling configuration parameters in packages/server/src/integrations/postgres.ts. Affected versions include all Budibase deployments prior to 3.39.19. The authentication requirement is an authenticated user session with administrative privileges capable of managing or testing datasources. Network exposure is constrained to the application tier communicating with the configured PostgreSQL database backend.\nPost-exploitation impact includes arbitrary SQL execution within the database context, potentially leading to privilege escalation, sensitive data access, remote code execution on the database server depending on database configurations, or complete integrity compromise of the data managed by the integration."
}