CVE-2026-82244: Improper Control of Generation of Code ('Code Injection') in budibase server
Description
Budibase server versions before 3.41.3 have a critical remote code execution vulnerability in plugin handling. Authenticated admin users can upload malicious plugin tarballs that execute arbitrary code via unsafe use of eval() on plugin JavaScript files. This flaw allows attackers to exfiltrate environment variables and credentials with root privileges in default deployments.
CVSS v4.0
Score 9.4critical
Affected software
budibase
server
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-82244 is a remote code execution vulnerability in Budibase server versions prior to 3.41.3. The vulnerability arises because the server unsafely calls eval() on JavaScript files from uploaded plugins without sandboxing, allowing authenticated admin users to execute arbitrary code. Exploitation can lead to exfiltration of sensitive environment variables and credentials with root-level access in default configurations.
Potential Impact
Successful exploitation grants attackers root privileges on the server, enabling full control including access to environment variables and credentials. This can lead to complete system compromise and data exfiltration.
Mitigation Recommendations
Upgrade Budibase server to version 3.41.3 or later where this vulnerability is fixed. No other mitigation is indicated. Patch status is confirmed by the affectedVersions field indicating fixed in 3.41.3.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-08-28T10:37:51.949Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a916f91acd9273b49cf92bc
Added to database: 08/28/2026, 11:22:57 UTC
Last enriched: 10/09/2026, 21:23:13 UTC
Last updated: 10/10/2026, 18:57:01 UTC
Views: 74
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.