Budibase's MongoDB query execution endpoint is vulnerable to NoSQL injection due to unsafe interpolation of user parameters into JSON query templates using Handlebars with escaping disabled. The validateQueryInputs() function blocks Handlebars bindings but does not sanitize JSON structural characters such as quotes or braces. This allows attackers to inject JSON metacharacters into parameters, altering the structure of MongoDB queries after JSON.parse(), bypassing intended filters. The resulting manipulated queries are executed directly against MongoDB collections, enabling attackers with query write permissions to read, modify, or delete arbitrary documents. The endpoint requires only PermissionType.QUERY with PermissionLevel.WRITE, accessible to regular app users, and does not enforce Joi schema validation on the request body, increasing risk.

An attacker with authenticated access as a regular app user and query write permissions can exploit this vulnerability to bypass intended query filters. This enables unauthorized data exfiltration by reading all documents in a MongoDB collection, including sensitive user or tenant data. Additionally, attackers can perform bulk modifications or deletions of documents by injecting broadened filters into updateMany or deleteMany queries. This can lead to significant data loss or unauthorized data manipulation within the affected Budibase instance.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict query write permissions to trusted users only and avoid exposing the vulnerable query execution endpoint to untrusted users. Review and sanitize all user-supplied parameters to prevent injection of JSON metacharacters. Implement strict schema validation on the request body to reject malicious inputs. Monitor vendor communications for official patches or updates addressing this vulnerability.