External risk intelligence

Budibase Plugin Handling Remote Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.4)

CVE-2026-82244

Budibase is a low-code platform commonly deployed as a web-based application or service that provides administrative interfaces. Since the vulnerability requires access to an administrative interface to upload plugins, and such web applications are frequently exposed to the internet for remote management or collaboration, it presents a likely attack surface.

Code Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory addresses a critical vulnerability in Budibase software that could allow authenticated administrators to execute arbitrary code. The issue stems from how the software handles plugin JavaScript files, potentially leading to the exfiltration of sensitive environment variables and credentials. The main concern is confirming relevance and exposure for affected systems.

Malicious plugins allow code execution.
Critical vulnerability impacts authenticated administrators.
Confirm relevance and exposure to sensitive data.

Attack Path

How an attacker could exploit the issue

An attacker with administrative access to Budibase can upload a malicious plugin to execute arbitrary code on the server. This vulnerability arises because the server evaluates JavaScript code from plugins without proper isolation, potentially leading to the exposure of sensitive information like environment variables and credentials with root privileges.

Authenticated admin user required.
Upload a malicious plugin tarball.
Execute arbitrary code with root privileges.

Live Threat

Current exploitation, exposure, and threat context

Authenticated administrators could execute arbitrary code, potentially leading to the exfiltration of environment variables and credentials. This could occur when a malicious plugin tarball is uploaded and its JavaScript files are processed without proper sandboxing in the main Node.js process.

Server environment variables and credentials at risk.
Malicious plugin upload and un-sandboxed code execution.
System compromise and unauthorized data access.

Operational Fix

Recommended remediation, mitigation, and detection steps

The real-world ownership for this vulnerability likely falls to the application or platform team responsible for managing Budibase instances, in coordination with security and infrastructure teams. The first practical step is to identify all Budibase deployments, confirm their reachability and business criticality, and then assign ownership for remediation planning.

Identify and assess Budibase deployments.
Verify administrative access and plugin upload capabilities.
Plan remediation based on identified risk and business impact.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Budibase?

Budibase is a low-code development platform used to quickly build internal business applications, workflows, and automated tools. It is commonly deployed as a web-based service where teams use an administrative interface to manage components, integrate data sources, and extend functionality through custom plugins.

What does CWE-94 mean for CVE-2026-82244?

CWE-94 refers to improper control of generation of code. In this specific case, the vulnerability means the software performs an eval() function on JavaScript files found within uploaded plugins. Because this process lacks sandboxing, the application interprets and runs the plugin's code directly within the main server process, allowing that code to perform unauthorized actions.

How is this vulnerability triggered?

An attacker must have valid administrative credentials to upload a specially crafted plugin tarball to the Budibase instance. Simply visiting the site or interacting with standard user features will not trigger the bug; it specifically requires the action of uploading and processing a malicious file through the administrative plugin management interface.

Is my Budibase instance at risk?

According to Halo Surface Signal, this vulnerability is likely relevant if your Budibase instance is exposed to the internet. Because the flaw requires administrative access, instances that are publicly accessible for remote management are at a higher risk than those restricted to an internal, private network.

What should I do to secure my system?

The most important first step is to locate all Budibase deployments in your environment and confirm their current version. Since this issue is resolved in version 3.41.3, you should prioritize upgrading any instances running older versions. Additionally, audit who has administrative privileges, as limiting access to the plugin upload feature reduces the potential for misuse.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.