Threats tagged 'ghsa-8mm2-5qwq-x6xp'

CVE-2026-100683 is a high-severity SQL injection vulnerability in Budibase server versions before 3.45.0. It arises from improper neutralization of special characters in SQL commands when renaming database columns via the Budibase UI. An attacker with DDL rights on a connected MySQL or MSSQL datasource can exploit this to execute arbitrary SQL statements with the privileges of Budibase's datasource user. This allows unauthorized reads, writes, or destructive operations on the connected database, bypassing Budibase's permission model. The issue is fixed in version 3.45.0.