Description

Budibase before 3.40.0 contains a NoSQL injection vulnerability in the MongoDB datasource integration where user-supplied parameters are enriched with handlebars using noEscaping: true and parsed without operator filtering. Attackers can inject MongoDB operators through query parameters to bypass per-user access controls, read arbitrary documents, execute JavaScript via $where operators, or modify collections through update and delete operations.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-13T12:17:26.627Z",
  "pubdate": "2026-08-13T12:17:26.627Z",
  "executiveSummary": "Budibase before 3.40.0 suffers from a critical NoSQL injection vulnerability within the MongoDB datasource integration. The flaw arises from the improper handling of user-supplied parameters, which are dynamically enriched using Handlebars templates with the noEscaping: true configuration and subsequently parsed without proper operator filtering.\nThis security deficiency allows remote attackers to supply malicious query parameters containing crafted MongoDB operators. Successful exploitation of this vulnerability permits unauthorized actors to bypass per-user access controls, retrieve arbitrary documents from the database, execute arbitrary JavaScript code via the $where operator, and perform unauthorized data modification or deletion across collections.\nThe vulnerability poses severe risk implications to confidentiality, integrity, and availability for organizations utilizing affected versions of Budibase with MongoDB datasources. Attackers require network access to the application interface where query parameters can be manipulated, but the absence of operator sanitization lowers the threshold for sophisticated data exfiltration and code execution attacks.",
  "technicalDetails": "The root cause of the vulnerability resides in the MongoDB datasource integration module of Budibase before 3.40.0. Specifically, user-supplied input parameters are dynamically interpolated into database queries using Handlebars template processing configured with noEscaping: true. This configuration disables standard output escaping mechanisms, allowing raw input strings to be directly embedded into the query structure.\nFurthermore, the application parses these enriched parameters without enforcing strict operator filtering or validation. Consequently, inputs containing malicious MongoDB query operators (such as $ne, $gt, or $where) are passed directly to the underlying MongoDB driver as part of the query execution context.\nThe attack flow proceeds in a step-by-step manner: 1) An attacker identifies an input vector that maps to query parameters within the MongoDB datasource integration. 2) The attacker crafts a specialized input payload embedding MongoDB query operators or JavaScript expressions. 3) The Budibase application processes the input using Handlebars with noEscaping: true, embedding the raw operator into the query object. 4) The query is executed against the MongoDB database without operator sanitization. 5) The database interprets the injected operators, altering the query logic to return unauthorized datasets, execute arbitrary JavaScript via $where, or execute update and delete operations.\nThe vulnerable component is the MongoDB datasource integration handler in Budibase versions prior to 3.40.0. Exploitation relies on the application's failure to sanitize and filter operational characters from interpolated parameters. Depending on the specific deployment configuration, authentication and specific user privileges may be bypassed entirely due to logic manipulation at the database query level, leading to complete compromise of the underlying data store."
}