VulnerabilityPublished 07/24/2026

Server: Budibase: NoSQL injection in MongoDB integration: collection dump, $where JS exec, cross-collection pivot, arbitrary update/delete

Affects @budibase/serverSource GCVE Database

CVSS 3.1 base score

7.1High

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

What to do

AI-suggested

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using MongoDB datasources with untrusted user input in Budibase or restrict BASIC user permissions. Builders should not rely on handlebars-enriched JSON with no escaping for query filtering. Consider implementing server-side query parameterization or input validation to prevent injection. Monitor vendor channels for patches or official fixes.

Affected software

Product	Affected	Fixed in
npm@budibase/server	Affected <=3.38.1	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

Budibase server versions up to 3.38.1 contain a NoSQL injection vulnerability in the MongoDB integration. This flaw allows BASIC app users to bypass query-level access controls intended to restrict data visibility per user. The vulnerability arises because user input is handlebars-enriched into MongoDB query JSON with no escaping, then parsed and executed without sanitization. Attackers can inject MongoDB operators to manipulate queries and retrieve or modify unauthorized documents.

Summary

Budibase's MongoDB datasource integration improperly processes user-supplied parameters by enriching query JSON with Handlebars using no escaping, then parsing it with JSON.parse. This allows injection of MongoDB operators that override intended per-user filters. The injected query reaches MongoDB's find operation unchanged, enabling BASIC users to bypass access controls and read or modify all documents accessible by the connection. Unlike SQL datasources, the MongoDB path lacks parameterization, making it vulnerable to NoSQL injection. A duplicate-key JSON trick enables attackers to craft filters that match all documents, demonstrated in Budibase 3.35.8 with MongoDB 6.

Impact

An attacker with BASIC user privileges can bypass the builder's per-user query filters and access all documents in the MongoDB datasource, potentially exposing sensitive data. The injection also allows arbitrary update or delete operations, compromising data integrity. The vulnerability leads to a confidentiality breach (full data read access) and partial integrity impact (arbitrary updates/deletes). Availability is not affected. The severity is high due to the broad data exposure and privilege bypass.

Weaknesses

CWE-89SQL Injection (opens in a new tab)

What to do

Affected software

Description

AnalysisAI-generated, updated 07/25/2026, 23:53:26 UTC

Technical details

Weaknesses

References

Related threats