Budibase: असुरक्षित eval() के माध्यम से रिमोट कोड एग्जीक्यूशन व्यू फिल्टर मैप फंक्शन में (Budibase Cloud)

The impact of CVE-2026-27702 is severe due to the potential for complete server takeover. An attacker exploiting this vulnerability could execute arbitrary code within the Budibase Cloud environment, gaining access to sensitive data, modifying application configurations, and potentially pivoting to other systems within the network. The app-service pod, where this vulnerability resides, has access to a wide range of resources, significantly expanding the attack surface. This vulnerability mirrors the danger of unchecked user input leading to code execution, similar to scenarios where unsanitized data is used in JavaScript eval() functions.

Budibase Cloud users, particularly those on free tier accounts, are at immediate risk. Organizations relying on Budibase Cloud for critical applications or storing sensitive data are especially vulnerable. Shared hosting environments utilizing Budibase Cloud may also be at increased risk due to potential cross-tenant exploitation.

• nodejs / server: Monitor Budibase Cloud logs for unusual JavaScript execution patterns or errors related to view filtering. Use journalctl to filter for errors containing 'eval' or 'inMemoryView.ts'. • generic web: Inspect Budibase Cloud application logs for suspicious requests targeting view endpoints. Use curl to test view endpoints with potentially malicious map functions and observe the response for unexpected behavior. • database (mongodb): While the vulnerability isn't directly in MongoDB, monitor MongoDB logs for unusual activity originating from the Budibase Cloud application pods.

1. 2026-02-25Disclosure

   disclosure

1. आरक्षित2026-02-23
2. प्रकाशित2026-02-25
3. EPSS अद्यतन2026-03-23

The primary mitigation for CVE-2026-27702 is to immediately upgrade Budibase Cloud to version 3.30.4 or later. For those unable to upgrade immediately, consider implementing stricter access controls to limit the number of authenticated users with potential access to view filtering functionality. While a direct WAF rule is difficult to implement due to the nature of the vulnerability, monitoring for unusual JavaScript execution patterns within the Budibase Cloud environment can provide early detection. After upgrading, verify the fix by attempting to create a view with a malicious map function and confirming that it is properly sanitized and does not result in code execution.