CVE-2026-73300
CriticalCVSS 9.6Summary
Budibase is an open-source low-code platform. Prior to 3.40.0, the MySQL integration component in Budibase is configured with multipleStatements: true, enabling execution of multiple SQL statements in a single query. Attackers can inject malicious SQL commands through user input fields, leading to complete database compromise. This vulnerability is fixed in 3.40.0.
Risk Assessment
The risk for the organization is complete database compromise, including the possibility of data theft, modification, or deletion.
Recommendation
It is recommended to immediately update Budibase to version 3.40.0 or later and review the MySQL integration configuration for security.
Original NVD description (English source)
Budibase is an open-source low-code platform. Prior to 3.40.0, the MySQL integration component in Budibase is configured with multipleStatements: true, enabling execution of multiple SQL statements in a single query. Attackers can inject malicious SQL commands through user input fields, leading to complete database compromise. This vulnerability is fixed in 3.40.0.