Description

Budibase Server before 3.40.0 contains a NoSQL injection vulnerability in the MongoDB query execution endpoint where user-supplied parameters are interpolated into JSON query templates without proper sanitization of JSON metacharacters. Attackers with query write permission can inject JSON structural characters to alter MongoDB queries, bypassing filters to read, modify, or delete arbitrary documents.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.3",
  "pubDate": "2026-08-13T12:17:26.770Z",
  "pubdate": "2026-08-13T12:17:26.770Z",
  "executiveSummary": "Budibase Server prior to version 3.40.0 suffers from a NoSQL injection vulnerability localized within the MongoDB query execution endpoint. The security defect arises from the improper sanitization of user-supplied parameters, allowing malicious payloads containing JSON metacharacters to be directly interpolated into JSON query templates. Consequently, adversaries who possess query write permissions can manipulate and alter the underlying structure of MongoDB queries during runtime. Successful exploitation of this vulnerability enables attackers to bypass existing logical filters, granting unauthorized read, modification, and deletion capabilities over arbitrary database documents. This introduces severe risks to data confidentiality, integrity, and availability within the targeted database instance. The attack requires authenticated access with specific query write privileges to successfully target the vulnerable endpoint.",
  "technicalDetails": "The vulnerability resides in the MongoDB query execution endpoint of Budibase Server, affecting all versions prior to 3.40.0. The root cause of the flaw is insecure string interpolation or template rendering where user-controlled input variables are embedded directly into JSON-based query templates without rigorous lexical analysis, type validation, or structural sanitization. Because JSON metacharacters are not properly escaped or stripped before query construction, an authenticated actor can supply crafted inputs containing operators such as $ne, $gt, or $where.\nThe attack flow proceeds as follows: first, an attacker authenticates to the Budibase Server instance and secures query write permissions. Second, the attacker crafts a malicious input string embedding MongoDB query operators and JSON structural characters. Third, the attacker submits this input through the vulnerable MongoDB query execution endpoint. Fourth, the server interpolates the unsanitized payload directly into the JSON query template, modifying the abstract syntax or logical evaluation tree of the intended database operation. Fifth, the database engine executes the altered query, bypassing access controls or retrieval filters.\nPost-exploitation impact includes the arbitrary extraction of sensitive records, unauthorized alteration of database contents, and the destruction of critical documents. The flaw demands network exposure of the target server and relies on the attacker possessing adequate initial privileges to author or execute queries within the platform."
}