CVE-2026-35216

Katalog CVE

CVSS 9.0 · Critical EPSS 1,2%

Kerentanan Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') pada budibase. Skor CVSS 3.1 9.0 (Critical) menurut github.com.

Deskripsi (NVD)

Budibase is an open-source low-code platform. Prior to version 3.33.4, an unauthenticated attacker can achieve Remote Code Execution (RCE) on the Budibase server by triggering an automation that contains a Bash step via the public webhook endpoint. No authentication is required to trigger the exploit. The process executes as root inside the container. This issue has been patched in version 3.33.4.

Rincian

Terbit di NVD

3 April 2026

Terakhir diubah

6 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

9.0 (Critical), sumber github.com
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

EPSS (30 hari)

1,2% peluang dieksploitasi; lebih tinggi dari 66,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/Budibase/budibase/security/advisories/GHSA-fcm4-4pj2-m5hf exploit · advisory vendor
• https://github.com/Budibase/budibase/commit/f0c731b409a96e401445a6a6030d2994ff4ac256 patch
• https://github.com/Budibase/budibase/pull/18238 issue tracking · patch
• https://github.com/Budibase/budibase/releases/tag/3.33.4 product · release notes