Sign in
Deutsch English Español Polski
Critical

Budibase affected by VM2 Constructor Escape Vulnerability

  • Disclosed: 01.03.2024
  • Updated: 11.10.2026 10:22

Impact

Previously, budibase used a library called vm2 for code execution inside the Budibase builder and apps, such as the UI below for configuring bindings in the design section.

Screenshot 2024-03-01 at 13 50 16

Due to a vulnerability in vm2, any environment that executed the code server side (automations and column formulas) was susceptible to this vulnerability, allowing users to escape the sandbox provided by vm2, and to expose server side variables such as process.env. It's recommended by the authors of vm2 themselves that you should move to another solution for remote JS execution due to this vulnerability.

Patches

We moved our entire JS sandbox infrastructure over to isolated-vm, a much more secure and recommended library for remote code execution in 2.20.0. This also comes with a performance benefit in the way we cache and execute your JS server side. The budibase cloud platform has been patched already and is not running vm2, but self host users will need to manage the updates by themselves.

If you are a self hosted user, you can take the following steps to reproduce the exploit and to verify if your installation is currently affected.

Create a new formula column on one of your tables in the data section with the following configuration. Screenshot 2024-03-01 at 14 04 28

Add the following JS function to the formula and save. Screenshot 2024-03-01 at 14 05 19

If your installation is vulnerable, when the formula evaluates you will be able to see the printed process.env in your new formula field. If not, your installation is not affected.

Workarounds

There is no workaround at this time for any budibase app that uses JS. You must fully migrate post version 2.20.0 to patch the vulnerability.

References

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
npm package @budibase/server < 2.20.0 2.20.0

References

CVSS score 9.8/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE)
CWE-94
Platform
npm
Package
@budibase/server
Disclosed
01.03.2024
Updated
11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-4g2x-vq5p-5vj6 - CC BY 4.0

Vulnerability history: @budibase/server

All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (42) in the archive
Total entries
42
First → latest
03.2024 08.2026
Without a fix
19
Exploited in attacks
0

Severity breakdown

  • Critical 8
  • High 27
  • Medium 7

Disclosures per year

Severity:
  1. Budibase authenticated arbitrary S3 signed upload URL issuance via `/api/attachments/:datasourceId/url`
    High · 7.1 CVE-2026-54356 <= 3.38.1 no fix
  2. Budibase: SSRF in Automation Steps - Webhook, Zapier, N8N, Slack, Discord Bypass IP Blacklist
    High CVE-2026-35219 < 3.41.3 3.41.3
  3. Budibase: SSRF via DNS rebinding in the REST datasource integration
    High · 8.5 CVE-2026-73410 <= 3.38.1 no fix
  4. Budibase: NoSQL injection in MongoDB integration: collection dump, $where JS exec, cross-collection pivot, arbitrary update/delete
    High · 7.1 CVE-2026-73617 <= 3.38.1 no fix
  5. Budibase: Chat-Link Handoff Identity Confusion (Same-Tenant Account-Link CSRF)
    High · 7.7 CVE-2026-72849 <= 3.38.1 no fix
  6. Budibase: MySQL DESCRIBE Backtick Injection via multipleStatements in Database Connector
    High · 7.6 CVE-2026-73408 <= 3.38.1 no fix
  7. Budibase: NoSQL Injection via JSON Parameter Interpolation in MongoDB Query Execution
    High · 8.3 CVE-2026-73618 <= 3.38.1 no fix
  8. Budibase: Unauthenticated user information disclosure via public tenant user lookup endpoint
    High · 7.5 CVE-2026-73406 <= 3.38.1 no fix
  9. Budibase: Unauthenticated REST Datasource Credential Theft via Cross-Origin Auth Leak
    Critical CVE-2026-73407 <= 3.38.1 no fix
  10. Budibase: OIDC SSO account takeover: incoming identity linked by email without checking email_verified
    Critical CVE-2026-73302 <= 3.38.1 no fix
  11. Budibase: DNS rebinding SSRF bypasses remain in OpenAPI import and REST query execution
    High · 8.5 CVE-2026-72855 <= 3.38.1 no fix
  12. Budibase: S3 presigned URL endpoint authorization regression in v3.39.4 allows BASIC users to obtain S3 PutObject presigned URLs
    High · 7.7 CVE-2026-72859 <= 3.38.1 no fix
  13. Budibase: Server Filesystem Existence/Read Oracle via Builder-Controlled MongoDB tlsCertificateKeyFile
    High CVE-2026-73409 <= 3.38.1 no fix
  14. Budibase: SQL Injection via `multipleStatements: true`
    Critical · 9.6 CVE-2026-73300 <= 3.38.1 no fix
  15. Budibase: Email Change IDOR via POST /api/v2/email allows full Account Takeover (accountId not validated against session)
    High CVE-2026-73303 <= 3.38.1 no fix
  16. Budibase: Privilege escalation via public role assignment API missing app-level authorization
    High · 8.8 CVE-2026-73305 <= 3.38.1 no fix
  17. Budibase has nonymous NoSQL operator injection via published-app query templates
    Critical · 10.0 CVE-2026-54350 < 3.39.12 3.39.12
  18. Budibase has arbitrary file read by workspace-builder via PWA-zip symlink upload
    Critical · 9.6 CVE-2026-54352 < 3.39.9 3.39.9
  19. Budibase: Mass Assignment in Webhook Trigger Allows Cross-Workspace Automation Execution via appId Override
    High · 8.2 CVE-2026-54351 < 3.39.9 3.39.9
  20. Budibase: POST /api/attachments/:datasourceId/url is unauthenticated and lets anonymous callers mint S3 PUT pre-signed URLs using stored datasource IAM credentials
    High · 9.4 CVE-2026-50137 < 3.39.0 3.39.0
  21. Budibase: Unauthenticated S3 signed upload URL generation allows arbitrary writes with stored datasource credentials
    High · 7.4 CVE-2026-50136 < 3.39.2 3.39.2
  22. Budibase has an Account Impersonation Issue — Chat Identity Link Hijacking via Missing Consent & CSRF
    High · 7.3 CVE-2026-50132 < 3.39.0 3.39.0
  23. Budibase: SSRF via OAuth2 token endpoint URL reaches internal hosts and cloud metadata
    High · 8.5 CVE-2026-48153 < 3.39.0 3.39.0
  24. Budibase: Basic app users can exfiltrate stored REST datasource auth by rewriting datasource base URL
    High · 8.1 CVE-2026-48152 < 3.39.0 3.39.0
  25. Budibase: Webhook schema endpoint authorization bypass allows unauthenticated mutation of webhook and automation schema
    High · 7.5 CVE-2026-48151 < 3.39.0 3.39.0
  26. Budibase: Workspace-scoped builder escalates to global admin via /api/public/v1/roles/assign
    Critical · 9.0 CVE-2026-48150 < 3.39.0 3.39.0
  27. Budibase: SSRF via OAuth2 Config Validation — Missing fetchWithBlacklist Protection
    High · 7.7 CVE-2026-48146 < 3.39.0 3.39.0
  28. Budibase: `PUT /api/datasources/:datasourceId` is protected only by `TABLE/READ` permission instead of builder access, allowing any authenticated app user to overwrite datasource connection parameters including host, port, and URL
    High · 8.8 CVE-2026-45717 < 3.38.1 3.38.1
  29. Budibase: SSRF Bypass via HTTP Redirect in REST Datasource Integration
    High · 7.7 CVE-2026-45715 < 3.38.1 3.38.1
  30. Budibase: SSRF in AI Extract File Automation Step via Missing IP Blacklist Validation
    High · 7.7 CVE-2026-45548 < 3.34.8 3.34.8
  31. Budibase: Unauthenticated Remote Code Execution via Webhook Trigger and Bash Automation Step
    Critical · 9.0 CVE-2026-35216 < 3.33.4 3.33.4
  32. Budibase: Path traversal in plugin file upload enables arbitrary directory deletion and file write
    High · 8.7 CVE-2026-35214 < 3.33.4 3.33.4
  33. Budibase: Command Injection in Bash Automation Step
    High · 8.8 CVE-2026-25044 < 3.33.4 3.33.4
  34. @budibase/server: Command Injection in PostgreSQL Dump Command
    High CVE-2026-25041 < 3.23.32 3.23.32
  35. Budibase affected by VM2 Constructor Escape Vulnerability this entry
    Critical · 9.8 ghsa-4g2x-vq5p-5vj6 < 2.20.0 2.20.0

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.