CVEvulnerability

CVE-2026-64657

8.4 HIGH Published 2026-08-17 Modified 2026-09-08 Official page ↗
Status
Deferred
Published
2026-08-17
Last modified
2026-09-08
Assigner
[email protected]
CVSS 3.1 ([email protected])
8.4 HIGH — CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
Weaknesses
CWE-89

Description

Budibase is an open-source low-code platform. Prior to 3.39.19, the PostgreSQL datasource connector in packages/server/src/integrations/postgres.ts interpolates the user-controlled schema configuration field into a SET search_path statement without escaping embedded double quotes, allowing an authenticated administrator who saves or tests the datasource to execute arbitrary SQL through the simple query protocol. This issue is fixed in version 3.39.19.

Related

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References