CVE-2026-25044 Budibase: Command Injection in Bash Automation Step

What is CVE-2026-25044?

CVE-2026-25044 is a high-severity command injection vulnerability in budibase, published on 3 Apr 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Budibase is an open-source low-code platform. Prior to version 3.33.4, the bash automation step executes user-provided commands using execSync without proper sanitization or validation. User input is processed through processStringSync which allows template interpolation, potentially allowing arbitrary command execution. This issue has been patched in version 3.33.4.

Weakness: CWE-78

Which versions are affected by CVE-2026-25044?

2 open source packages ship an affected version, including @budibase/server. It affects 1 product.

Products include Budibase Budibase.

How do I fix CVE-2026-25044?

Upgrade @budibase/server to 3.33.4 or later.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2026-25044 being exploited?

There is no known exploitation of CVE-2026-25044 in the wild and no public exploit code.

Other vulnerabilities in budibase

• CVE-2026-54350 Budibase: Anonymous NoSQL operator injection via published-app query templates Critical 10.0
• CVE-2026-27702 Budibase Vulnerable to Remote Code Execution via Unsafe eval() in View Filter Map Function (Budibase Cloud) Critical 9.9
• CVE-2026-54352 Budibase: Arbitrary file read by workspace-builder via PWA-zip symlink upload Critical 9.6
• CVE-2026-31818 Budibase: Server-Side Request Forgery via REST Connector with Empty Default Blacklist Critical 9.6
• CVE-2026-30240 Budibase PWA ZIP Upload Path Traversal Allows Reading Arbitrary Server Files Including All Environment Secrets Critical 9.6

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-gjw9-34gf-rp6m.