Description

Budibase versions before 3.41.3 contain a remote code execution vulnerability in plugin handling that allows authenticated admin users to execute arbitrary code by uploading a malicious plugin tarball. The server calls eval() on plugin JavaScript files without sandboxing in the main Node.js process, enabling attackers to exfiltrate environment variables and credentials with root privileges in default deployments.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-28T12:16:34.653Z",
  "pubdate": "2026-08-28T12:16:34.653Z",
  "executiveSummary": "Budibase versions prior to 3.41.3 are susceptible to a critical Remote Code Execution (RCE) vulnerability within the platform's plugin architecture.\nThe flaw stems from insecure handling of uploaded plugin tarball files, specifically the unsanitized execution of bundled JavaScript code.\nThis vulnerability allows an authenticated user with administrative privileges to bypass intended security controls and execute arbitrary code directly within the host's Node.js process.\nThe risk implication is severe, as the application runs with elevated system permissions in default configurations, effectively granting the attacker full control over the host environment.\nSuccessful exploitation facilitates unauthorized access to sensitive configuration data, including environment variables and platform credentials.\nThe exploitation requirement is limited to an attacker having authenticated administrative access to the Budibase management interface.\nGiven the ability to escape the application context, this vulnerability poses a significant threat to the confidentiality, integrity, and availability of the underlying server infrastructure.",
  "technicalDetails": "The vulnerability resides in the Budibase plugin management subsystem, which facilitates the extension of application functionality via the deployment of external modules.\nThe root cause of the vulnerability is the application's failure to perform secure validation or sandboxing of the JavaScript code contained within uploaded plugin tarball archives.\nUpon uploading a malicious plugin package, the Budibase server facilitates the installation process by extracting the contents of the archive. The system subsequently loads and processes JavaScript files included in the plugin structure.\nThe application invokes the JavaScript eval() function to process these files, executing them directly within the main Node.js process runtime without the implementation of an isolated sandbox or context restriction.\nBecause the execution occurs within the main process, the code operates with the same privilege level as the application server itself, which is often root in default containerized or bare-metal deployments.\nThe attack flow proceeds as follows: First, the attacker prepares a crafted tarball containing a malicious plugin structure, inserting arbitrary JavaScript logic into a target plugin file. Second, the attacker authenticates to the Budibase administrative interface and navigates to the plugin management section. Third, the attacker initiates a plugin upload, providing the weaponized archive. Finally, upon the application's ingestion and subsequent evaluation of the malicious script, the payload executes.\nThe payload behavior is unrestricted; the attacker can leverage Node.js APIs to interact with the underlying operating system. This includes, but is not limited to, executing system shell commands, traversing the filesystem to steal sensitive environment variables, exfiltrating secret keys used for authentication, or installing persistent backdoors.\nThe vulnerability affects all Budibase versions prior to 3.41.3. Due to the inherent trust placed in the plugin ingestion process, the application lacks the mechanisms required to prevent the transition from a legitimate administrative action to arbitrary code execution. Post-exploitation impact is catastrophic, as the compromise of the Node.js process environment directly exposes the application's configuration, database connections, and potential lateral movement vectors within the network."
}