CVE-2026-27702

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-27702", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-23T17:56:51.202Z", "datePublished": "2026-02-25T15:11:16.324Z", "dateUpdated": "2026-02-25T20:43:35.833Z"}, "containers": {"cna": {"title": "Budibase Vulnerable to Remote Code Execution via Unsafe eval() in View Filter Map Function (Budibase Cloud)", "problemTypes": [{"descriptions": [{"cweId": "CWE-20", "lang": "en", "description": "CWE-20: Improper Input Validation", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-94", "lang": "en", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-95", "lang": "en", "description": "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/Budibase/budibase/security/advisories/GHSA-rvhr-26g4-p2r8", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/Budibase/budibase/security/advisories/GHSA-rvhr-26g4-p2r8"}, {"name": "https://github.com/Budibase/budibase/pull/18087", "tags": ["x_refsource_MISC"], "url": "https://github.com/Budibase/budibase/pull/18087"}, {"name": "https://github.com/Budibase/budibase/commit/348659810cf930dda5f669e782706594c547115d", "tags": ["x_refsource_MISC"], "url": "https://github.com/Budibase/budibase/commit/348659810cf930dda5f669e782706594c547115d"}, {"name": "https://github.com/Budibase/budibase/releases/tag/3.30.4", "tags": ["x_refsource_MISC"], "url": "https://github.com/Budibase/budibase/releases/tag/3.30.4"}], "affected": [{"vendor": "Budibase", "product": "budibase", "versions": [{"version": "< 3.30.4", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-25T15:11:16.324Z"}, "descriptions": [{"lang": "en", "value": "Budibase is a low code platform for creating internal tools, workflows, and admin panels. Prior to version 3.30.4, an unsafe `eval()` vulnerability in Budibase's view filtering implementation allows any authenticated user (including free tier accounts) to execute arbitrary JavaScript code on the server. This vulnerability ONLY affects Budibase Cloud (SaaS) - self-hosted deployments use native CouchDB views and are not vulnerable. The vulnerability exists in `packages/server/src/db/inMemoryView.ts` where user-controlled view map functions are directly evaluated without sanitization. The primary impact comes from what lives inside the pod's environment: the `app-service` pod runs with secrets baked into its environment variables, including `INTERNAL_API_KEY`, `JWT_SECRET`, CouchDB admin credentials, AWS keys, and more. Using the extracted CouchDB credentials, we verified direct database access, enumerated all tenant databases, and confirmed that user records (email addresses) are readable. Version 3.30.4 contains a patch."}], "source": {"advisory": "GHSA-rvhr-26g4-p2r8", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-25T20:43:20.935389Z", "id": "CVE-2026-27702", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-25T20:43:35.833Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-27702", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-25T20:43:20.935389Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-25T20:43:27.652Z"}}], "cna": {"title": "Budibase Vulnerable to Remote Code Execution via Unsafe eval() in View Filter Map Function (Budibase Cloud)", "source": {"advisory": "GHSA-rvhr-26g4-p2r8", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.9, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "Budibase", "product": "budibase", "versions": [{"status": "affected", "version": "< 3.30.4"}]}], "references": [{"url": "https://github.com/Budibase/budibase/security/advisories/GHSA-rvhr-26g4-p2r8", "name": "https://github.com/Budibase/budibase/security/advisories/GHSA-rvhr-26g4-p2r8", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/Budibase/budibase/pull/18087", "name": "https://github.com/Budibase/budibase/pull/18087", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/Budibase/budibase/commit/348659810cf930dda5f669e782706594c547115d", "name": "https://github.com/Budibase/budibase/commit/348659810cf930dda5f669e782706594c547115d", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/Budibase/budibase/releases/tag/3.30.4", "name": "https://github.com/Budibase/budibase/releases/tag/3.30.4", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Budibase is a low code platform for creating internal tools, workflows, and admin panels. Prior to version 3.30.4, an unsafe `eval()` vulnerability in Budibase's view filtering implementation allows any authenticated user (including free tier accounts) to execute arbitrary JavaScript code on the server. This vulnerability ONLY affects Budibase Cloud (SaaS) - self-hosted deployments use native CouchDB views and are not vulnerable. The vulnerability exists in `packages/server/src/db/inMemoryView.ts` where user-controlled view map functions are directly evaluated without sanitization. The primary impact comes from what lives inside the pod's environment: the `app-service` pod runs with secrets baked into its environment variables, including `INTERNAL_API_KEY`, `JWT_SECRET`, CouchDB admin credentials, AWS keys, and more. Using the extracted CouchDB credentials, we verified direct database access, enumerated all tenant databases, and confirmed that user records (email addresses) are readable. Version 3.30.4 contains a patch."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20: Improper Input Validation"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-95", "description": "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-25T15:11:16.324Z"}}}, "cveMetadata": {"cveId": "CVE-2026-27702", "state": "PUBLISHED", "dateUpdated": "2026-02-25T20:43:35.833Z", "dateReserved": "2026-02-23T17:56:51.202Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-25T15:11:16.324Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "budibase", "vendor": "Budibase", "versions": [{"status": "affected", "version": "< 3.30.4"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:budibase:budibase:*:*:*:*:*:*:*:*", "matchCriteriaId": "6366022F-080A-40DB-B1E9-CD5811BED55D", "versionEndExcluding": "3.30.4", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Budibase is a low code platform for creating internal tools, workflows, and admin panels. Prior to version 3.30.4, an unsafe `eval()` vulnerability in Budibase's view filtering implementation allows any authenticated user (including free tier accounts) to execute arbitrary JavaScript code on the server. This vulnerability ONLY affects Budibase Cloud (SaaS) - self-hosted deployments use native CouchDB views and are not vulnerable. The vulnerability exists in `packages/server/src/db/inMemoryView.ts` where user-controlled view map functions are directly evaluated without sanitization. The primary impact comes from what lives inside the pod's environment: the `app-service` pod runs with secrets baked into its environment variables, including `INTERNAL_API_KEY`, `JWT_SECRET`, CouchDB admin credentials, AWS keys, and more. Using the extracted CouchDB credentials, we verified direct database access, enumerated all tenant databases, and confirmed that user records (email addresses) are readable. Version 3.30.4 contains a patch."}, {"lang": "es", "value": "Budibase es una plataforma de bajo c\u00f3digo para crear herramientas internas, flujos de trabajo y paneles de administraci\u00f3n. Antes de la versi\u00f3n 3.30.4, una `vulnerabilidad` `eval()` insegura en la implementaci\u00f3n de filtrado de vistas de Budibase permite a cualquier usuario autenticado (incluidas las cuentas de nivel gratuito) ejecutar c\u00f3digo JavaScript arbitrario en el `servidor`. Esta `vulnerabilidad` SOLO afecta a Budibase Cloud (SaaS) - las implementaciones autoalojadas usan vistas nativas de CouchDB y no son `vulnerables`. La `vulnerabilidad` existe en `packages/server/src/db/inMemoryView.ts` donde las funciones de mapeo de vistas controladas por el usuario se eval\u00faan directamente sin sanitizaci\u00f3n. El `impacto` principal proviene de lo que reside dentro del entorno del pod: el pod `app-service` se ejecuta con secretos incorporados en sus variables de entorno, incluyendo `INTERNAL_API_KEY`, `JWT_SECRET`, credenciales de administrador de CouchDB, claves de AWS y m\u00e1s. Usando las credenciales de CouchDB extra\u00eddas, verificamos el acceso directo a la `base de datos`, enumeramos todas las `bases de datos` de inquilinos, y confirmamos que los registros de usuario (direcciones de correo electr\u00f3nico) son legibles. La versi\u00f3n 3.30.4 contiene un `parche`."}], "id": "CVE-2026-27702", "lastModified": "2026-06-17T10:27:32.633", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 6.0, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.0, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 6.0, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-27702", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-02-25T20:43:20.935389Z", "version": "2.0.3"}}]}, "published": "2026-02-25T16:23:26.777", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/Budibase/budibase/commit/348659810cf930dda5f669e782706594c547115d"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking"], "url": "https://github.com/Budibase/budibase/pull/18087"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/Budibase/budibase/releases/tag/3.30.4"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/Budibase/budibase/security/advisories/GHSA-rvhr-26g4-p2r8"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-94"}, {"lang": "en", "value": "CWE-95"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-94"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.30.4)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "budibase", "source": "cna", "vendor": "Budibase"}, "product": "budibase", "vendor": "budibase"}], "analysis": {"en": {"generated_at": "2026-04-17T15:14:00.125955+00:00", "value": {"mitigation_remediation": ["Upgrade Budibase to version 3.30.4 or later, which removes the unsafe eval() usage.", "If an immediate upgrade is not possible, disable or restrict the use of custom view map functions to read\u2011only execution contexts.", "rotate any exposed secrets or credentials that could have been compromised during exploitation, such as CouchDB admin keys, AWS access keys and secrets, and JWT signing keys.", " monitor application logs for unexpected JavaScript execution or unauthorized database queries to detect attempts in progress."], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "Budibase servers that run the Budibase Cloud (SaaS) offering and use software versions prior to 3.30.4 are vulnerable. Self\u2011hosted deployments are not affected because they rely on native CouchDB views, which are not processed by the vulnerable component. Any SaaS instance where the app\u2011service runs with environment variables containing secrets such as INTERNAL_API_KEY, JWT_SECRET, CouchDB admin credentials, and AWS keys is at risk.", "description_and_impact": "An unsafe use of eval() in Budibase\u2019s view filtering implementation allows an authenticated user to execute arbitrary JavaScript on the server. Because the eval() call evaluates user\u2011controlled map functions with no sanitization, a malicious actor can run code with the same privileges as the app\u2011service pod, exposing internal secrets and database credentials. This can ultimately compromise the entire deployment, including user data, API keys, and other sensitive information.", "risk_and_exploitability": "The CVSS score of 9.9 reflects a high\u2011severity remote code execution vulnerability that requires only authentication. The EPSS score of < 1% indicates that current exploitation attempts are rare, yet the impact of a successful exploit is substantial, providing full server compromise and data exfiltration. Because the vulnerability is not listed in the KEV catalog, there is no trace of widespread use, but the presence of privileged secrets in the pod\u2019s environment makes exploitation extremely valuable to attackers. Attackers can trigger the flaw by crafting a malicious view filter through the cloud interface, requiring only valid user credentials."}}}}, "created": "2026-02-26T13:15:56.135704+00:00", "updated": "2026-04-17T15:15:21.858131+00:00", "vendors": ["budibase", "budibase$PRODUCT$budibase"]}