CVE Intelligence
Analysis AI-assisted

CVE-2026-27702: Budibase Cloud Code Injection via Unsafe eval() in View Filter

Budibase Cloud contains an unsafe eval() call in its view filter map function, which lets any authenticated user, including free tier accounts, run arbitrary JavaScript on the server. The advisory states that self-hosted deployments are not affected. The fix is included in version 3.30.4.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

Budibase is a low-code platform for internal tools, workflows and admin panels. According to the GitHub security advisory, a view filtering implementation evaluates user-supplied map functions with eval() without sanitization. The weakness is classified as CWE-94 (Code Injection) and is described as affecting Budibase Cloud only.

Impact

  • Any authenticated user, including free tier accounts, may be able to run arbitrary JavaScript on the server, according to the advisory.
  • The advisory states that the app-service environment holds secrets, including internal API, session signing and database credentials, so server-side code execution could expose them.
  • The reporter states that database access was verified and that user email addresses were readable. The advisory does not state whether any real-world data was accessed.

Affected products and versions

Exploitation status

  • CISA KEV does not list this CVE in the record, so no confirmed active exploitation is recorded in the sources consulted.
  • The SSVC exploitation field in the record is set to proof-of-concept level. This describes available technical material, not observed attacks.
  • The EPSS probability is 0.00641 with a percentile of 0.5011, dated 2026-10-23.

Remediation and mitigation

  • Confirm that the Budibase Cloud deployment runs version 3.30.4 or later. For SaaS, this is generally handled by the vendor, so customers should check the vendor communication or status.
  • Self-hosted operators should verify whether they use the affected view mechanism; the advisory says they are not vulnerable.
  • Inference: if exposure of the secrets listed in the advisory is suspected, rotating them after confirming the patch is a reasonable precaution.
  • Inference: limit which accounts can create or modify view definitions, and review accounts that do not need elevated functionality.

Detection guidance

  • Review application audit logs for creation or modification of views by unexpected users or by accounts with no operational need.
  • Review CouchDB access logs for administrative-level activity that does not match normal operations.
  • Monitor the app-service environment for unexpected outbound connections or process behaviour.

Limitations of the available information

  • The record does not state the earliest affected version, so the lower bound of the vulnerable range is unknown.
  • NVD assigns a CVSS base score of 9.0 while the GitHub provider score in the record is 9.9; both are reported here without choosing one.
  • The advisory's proof-of-concept claims are reported by the vendor and were not independently verified here.
  • The record does not state whether any compromise occurred in production.
  • The EPSS date in the record is later than the publication date, so its timing should be interpreted with care.

Frequently asked questions

Is self-hosted Budibase affected by CVE-2026-27702?

The advisory states that self-hosted deployments, which use native CouchDB views, are not vulnerable. Only Budibase Cloud is described as affected.

Which version fixes this issue?

The record references version 3.30.4 as containing the patch, and the affected range is described as before 3.30.4.

Is this vulnerability known to be actively exploited?

CISA KEV does not list this CVE in the record, and no confirmed active exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.