CVE-2026-27702: Budibase Remote Code Execution via Unsafe eval() in View Filter Map Function
Summary
CVE-2026-27702: Budibase: Remote Code Execution via Unsafe eval() in View Filter Map Function (Budibase Cloud). Affects budibase versions < 3.30.4. Fixed in 3.30.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Budibase is an open-source platform designed for building internal tools and applications quickly. It allows users to create applications with a low-code approach, utilizing a variety of data sources. Budibase Cloud, the Software as a Service (SaaS) version, is particularly popular for its ease of use and accessibility. However, a critical vulnerability has been identified in its view filtering implementation, which poses significant security risks to users.
Vulnerability Detail
A critical unsafe eval() vulnerability exists in Budibase's view filtering implementation, allowing any authenticated user, including free tier accounts, to execute arbitrary JavaScript code on the server. This vulnerability specifically affects Budibase Cloud, as self-hosted deployments utilize native CouchDB views and are not vulnerable. The issue arises from user-controlled view map functions being evaluated without proper sanitization, leading to potential remote code execution (RCE) on the server. The impact is severe, as the app-service pod runs with sensitive environment variables, including API keys and database credentials, which can be exploited by attackers.
How To Fix
Minimum fixed version
3.30.4
This is the first release that contains the fix.
npm install budibase@3.30.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using custom view filters that include user-defined JavaScript code until the package is updated. If possible, restrict access to the view filtering functionality to trusted users only.
Conclusion
The CVE-2026-27702 vulnerability in Budibase poses a significant risk to users of the Budibase Cloud platform. It is crucial for users to update to the patched version 3.30.4 to mitigate the risk of remote code execution. Additionally, utilizing tools like Vulert can help monitor and alert for open-source vulnerabilities in real-time.
See every vulnerability recorded for budibase →
FAQ
CVE-2026-27702 is a critical vulnerability in Budibase that allows remote code execution via unsafe eval() in the view filter map function.
Any authenticated user of Budibase Cloud, including free tier accounts, is potentially affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability can lead to remote code execution on the server, allowing attackers to access sensitive environment variables and potentially compromise user data.
If an immediate update is not possible, restrict access to the view filtering functionality and avoid using custom JavaScript in view filters until the package is updated.
References
Related vulnerabilities
Recent vulnerabilities recorded for budibase.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
