Budibase: Remote Code Execution via Unsafe eval() in View Filter Map Function (Budibase Cloud)

The impact of this vulnerability is severe. An attacker can leverage it to execute arbitrary code within the Budibase Cloud environment, potentially gaining full control of the affected application and its underlying infrastructure. This could lead to data breaches, unauthorized modifications to the application, and even complete system compromise. The attacker's ability to execute code within the app-service pod grants them access to resources and data within that container, significantly expanding the potential blast radius. The ease of exploitation, requiring only authentication, makes this a high-priority risk.

Budibase Cloud users, particularly those on free tier accounts, are at immediate risk. Organizations relying on Budibase Cloud for critical applications or storing sensitive data are especially vulnerable. Shared hosting environments utilizing Budibase Cloud may also be at increased risk due to potential cross-tenant exploitation.

• nodejs / server: Monitor Budibase Cloud logs for unusual JavaScript execution patterns or errors related to view filtering. Use journalctl to filter for errors containing 'eval' or 'inMemoryView.ts'. • generic web: Inspect Budibase Cloud application logs for suspicious requests targeting view endpoints. Use curl to test view endpoints with potentially malicious map functions and observe the response for unexpected behavior. • database (mongodb): While the vulnerability isn't directly in MongoDB, monitor MongoDB logs for unusual activity originating from the Budibase Cloud application pods.

1. 2026-02-25Disclosure

   disclosure

1. Reserviert2026-02-23
2. Veröffentlicht2026-02-25
3. EPSS aktualisiert2026-03-23

The primary mitigation is to immediately upgrade to Budibase Cloud version 3.30.4 or later. For environments where immediate upgrades are not possible, consider restricting user permissions to limit the potential impact of a successful exploit. While not a complete solution, implementing strict input validation on user-supplied data used in view map functions can help reduce the attack surface. Monitor Budibase Cloud logs for suspicious activity, particularly any unusual JavaScript execution patterns. There are no specific WAF rules or detection signatures readily available, making timely patching crucial.