CVE-2026-48149
HighSummary
Budibase is an open-source low-code platform. In versions prior to 3.39.0, the Budibase Text component renders markdown by assigning marked.parse(markdown) without a sanitizer, leading to an XSS vulnerability.
Risk Assessment
Any BASIC app user with WRITE permissions on the underlying table can exploit this vulnerability, potentially injecting malicious code into the application.
Recommendation
It is recommended to upgrade to version 3.39.0 or later to mitigate this vulnerability.
Original NVD description (English source)
Budibase is an open-source low-code platform. Prior to 3.39.0, the Budibase Text component renders markdown by assigning marked.parse(markdown) straight to innerHTML with no sanitizer (packages/bbui/src/Markdown/MarkdownViewer.svelte:22). Any column a builder binds to a Text component in Markdown mode is a stored-XSS sink writable by every BASIC app user with WRITE on the underlying table. This vulnerability is fixed in 3.39.0.