CVE-2026-82244

Budibase versions before 3.41.3 contain a code-injection flaw (CWE-94) in plugin handling: the server evaluates JavaScript files bundled in an uploaded plugin tarball with eval() directly in the main Node.js process, with no sandboxing. An authenticated admin user triggers the flaw by uploading a crafted plugin tarball, causing the plugin's JavaScript to execute with the full privileges of the server process. In default deployments this yields arbitrary code execution on the host, including the ability to read environment variables and stored credentials, running with root privileges — a stronger position than the admin role normally implies. All Budibase deployments running any version prior to 3.41.3 are affected. There is no public proof-of-concept, the issue is not in CISA KEV, and EPSS assigns roughly a 0.6% probability of exploitation within 30 days, so no exploitation is currently known.

What to do: Upgrade to Budibase 3.41.3 or later. Until upgraded, limit plugin uploads to fully trusted admins, audit recently installed or uploaded plugins, and run the Budibase service with least privilege (non-root container, minimal environment secrets); if compromise is suspected, rotate any credentials exposed through environment variables.