CVE-2026-64657
HighCVSS 8.4Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
Budibase prior to version 3.39.19 has a vulnerability in the PostgreSQL datasource connector where the user-controlled schema field is interpolated into a SET search_path statement without escaping embedded double quotes, allowing an authenticated administrator to execute arbitrary SQL.
Risk Assessment
An administrator with access to datasource configuration could execute unauthorized SQL queries, potentially leading to data breaches or privilege escalation.
Recommendation
Upgrade Budibase to version 3.39.19, which contains the fix.
Original NVD description (English source)
Budibase is an open-source low-code platform. Prior to 3.39.19, the PostgreSQL datasource connector in packages/server/src/integrations/postgres.ts interpolates the user-controlled schema configuration field into a SET search_path statement without escaping embedded double quotes, allowing an authenticated administrator who saves or tests the datasource to execute arbitrary SQL through the simple query protocol. This issue is fixed in version 3.39.19.