CVE-2026-64657 in Budibase
Summary
by MITRE • 08/17/2026
Budibase is an open-source low-code platform. Prior to 3.39.19, the PostgreSQL datasource connector in packages/server/src/integrations/postgres.ts interpolates the user-controlled schema configuration field into a SET search_path statement without escaping embedded double quotes, allowing an authenticated administrator who saves or tests the datasource to execute arbitrary SQL through the simple query protocol. This issue is fixed in version 3.39.19.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/17/2026
The vulnerability identified in Budibase prior to version 3.39.19 represents a critical server-side code injection flaw within its PostgreSQL data source connector, specifically located in the file packages/server/src/integrations/postgres.ts. This low-code platform allows administrators to configure external database connections for application development and integration purposes. The core technical deficiency lies in how the system handles user-supplied input when constructing SQL commands. Specifically, when an administrator saves or tests a datasource configuration that includes a schema name, the application directly interpolates this unescaped value into a SET search_path statement. This operation is performed without implementing proper sanitization or parameterized query mechanisms to neutralize special characters, most notably embedded double quotes which are significant in PostgreSQL syntax for identifying identifiers such as schemas and tables.
From an operational perspective, this flaw enables authenticated administrators with the ability to manage data sources to execute arbitrary SQL commands against the underlying database engine. By carefully crafting a schema name that includes malicious SQL payloads wrapped in appropriate quoting mechanisms, an attacker can break out of the intended SET search_path context and append additional statements to the query string. Because PostgreSQL supports multiple statements separated by semicolons within a single simple query protocol execution, this allows for the injection of commands such as data exfiltration queries, destructive DROP TABLE operations, or even command execution if specific database extensions are enabled and configured with sufficient privileges. The impact is severe because it compromises the integrity and confidentiality of all databases accessible to that PostgreSQL instance, effectively granting full control over the backend storage layer through a seemingly benign configuration interface.
This vulnerability aligns closely with Common Weakness Enumeration (CWE) identifiers such as CWE-94 Improper Control of Generation of Code or SQL Injection, specifically falling under the category where user input is directly concatenated into code structures without validation. In terms of the MITRE ATT&CK framework, this behavior facilitates lateral movement and data exfiltration techniques by allowing an attacker to leverage existing application privileges to interact with backend systems in unintended ways. The attack vector requires authentication as an administrator or a role with datasource management permissions, which limits immediate exploitation but does not mitigate the severity once such access is obtained through credential theft, privilege escalation, or social engineering attacks against high-privilege accounts.
To remediate this issue, organizations must upgrade to Budibase version 3.39.19 or later, where the developers have implemented proper escaping and validation for schema names before they are used in SQL statements. In addition to applying the patch, security teams should enforce strict input validation on all configuration fields that interact with database engines, ensuring that only alphanumeric characters and safe delimiters are permitted unless explicitly required by business logic. Implementing parameterized queries or prepared statements wherever possible is a fundamental best practice to prevent injection attacks regardless of the specific syntax involved. Furthermore, principle of least privilege should be applied to database accounts used by applications, ensuring that even if an injection occurs, the compromised account lacks permissions for destructive operations like DROP TABLES or sensitive data extraction from unrelated schemas. Regular security audits and static code analysis tools configured to detect SQL concatenation patterns can help identify similar vulnerabilities in custom integrations before they reach production environments.