CVE-2026-35218 in Budibase

Resumen (Inglés)

Budibase is an open-source low-code platform. Prior to version 3.32.5, Budibase's Builder Command Palette renders entity names (tables, views, queries, automations) using Svelte's {@html} directive without any sanitization. An authenticated user with Builder access can create a table, automation, view, or query whose name contains an HTML payload (e.g. ). When any Builder-role user in the same workspace opens the Command Palette (Ctrl+K), the payload executes in their browser, stealing their session cookie and enabling full account takeover. This issue has been patched in version 3.32.5.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Responsable

GitHub_M

Reservar

2026-04-01

Divulgación

2026-04-03

Estado

Confirmado

Voces

VulDB provides additional information and datapoints for this CVE:

ID	Vulnerabilidad	CWE	Exp	Con	CVE
355179	Budibase secuencias de comandos en sitios cruzados	79	No está definido	Arreglo oficial	CVE-2026-35218

Fuentes

• MITRE
• NVD
• CVE Details