CVE-2026-82244 Budibase before 3.41.3 Remote Code Execution via Plugin eval()
Authenticated admins can execute arbitrary code via malicious plugins due to unsandboxed eval(), leading to root-level compromise.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-82244?
CVE-2026-82244 is a critical code injection vulnerability in budibase server, published on 28 Aug 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Budibase versions before 3.41.3 contain a remote code execution vulnerability in plugin handling that allows authenticated admin users to execute arbitrary code by uploading a malicious plugin tarball. The server calls eval() on plugin JavaScript files without sandboxing in the main Node.js process, enabling attackers to exfiltrate environment variables and credentials with root privileges in default deployments.
Weakness: CWE-94
Which versions are affected by CVE-2026-82244?
How do I fix CVE-2026-82244?
No fix has been published for CVE-2026-82244 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-82244 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-82244 exists.
Sources
Also known as GHSA-8j7v-pg7g-633j, GHSA-gwr2-pgg3-p7xp.