SQL Injection Affecting @budibase/server package, versions *
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JS-BUDIBASESERVER-18319707
- published26 Jul 2026
- disclosed24 Jul 2026
- creditUnknown
Introduced: 24 Jul 2026
New CVE NOT AVAILABLE CWE-89 (opens in a new tab)How to fix?
A fix was pushed into the master branch but not yet published.
Overview
@budibase/server is a Budibase Web Server
Affected versions of this package are vulnerable to SQL Injection via the multipleStatements configuration in the MySQL integration. An attacker can execute arbitrary SQL commands by injecting malicious input into user fields, potentially leading to data destruction, data theft, privilege escalation, denial of service, and complete database compromise.
Workaround
This vulnerability can be mitigated by temporarily disabling the MySQL integration, implementing a web application firewall (WAF), or restricting database user privileges.