budibase up to 3.38.0 Request Body /api/views SCHEMA_MAP code injection

Summaryinfo

A vulnerability labeled as critical has been found in budibase up to 3.38.0. This impacts an unknown function of the file /api/views of the component Request Body Handler. The manipulation of the argument SCHEMA_MAP results in code injection. This vulnerability is cataloged as CVE-2026-45719. The attack may be launched remotely. There is no exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability, which was classified as critical, was found in budibase up to 3.38.0. Affected is an unknown part of the file /api/views of the component Request Body Handler. The manipulation of the argument SCHEMA_MAP with an unknown input leads to a code injection vulnerability. CWE is classifying the issue as CWE-94. The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Budibase is an open-source low-code platform. Prior to 3.38.1, the V1 Views API (POST /api/views) accepts a calculation parameter from the request body that is interpolated directly into a CouchDB reduce function definition without validation. Although an internal SCHEMA_MAP object defines the valid calculation types (sum, count, stats), no actual validation is performed against this map before the value is used in string interpolation. A user with Builder permissions can inject arbitrary JavaScript code that will be executed within the CouchDB JavaScript engine when the view is queried. This vulnerability is fixed in 3.38.1.

The advisory is available at github.com. This vulnerability is traded as CVE-2026-45719 since 05/13/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. Additional levels of successful authentication are needed for exploitation. Technical details are known, but there is no available exploit. This vulnerability is assigned to T1059 by the MITRE ATT&CK project.

Upgrading to version 3.38.1 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-32599). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Name

• budibase

Version

• 3.0
• 3.1
• 3.2
• 3.3
• 3.4
• 3.5
• 3.6
• 3.7
• 3.8
• 3.9
• 3.10
• 3.11
• 3.12
• 3.13
• 3.14
• 3.15
• 3.16
• 3.17
• 3.18
• 3.19
• 3.20
• 3.21
• 3.22
• 3.23
• 3.24
• 3.25
• 3.26
• 3.27
• 3.28
• 3.29
• 3.30
• 3.31
• 3.32
• 3.33
• 3.34
• 3.35
• 3.36
• 3.37
• 3.38.0

Website

• Product: https://github.com/Budibase/budibase/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion