CVE-2026-27702

In the file packages/server/src/db/inMemoryView.ts, user-supplied view mapping functions are passed directly to eval() without any sanitization or validation (CWE-20, CWE-94, CWE-95). An attacker can prepare a malicious payload as a view filter function and execute it in the context of the application server process. The environment under app-service contains environment variables with sensitive secrets, including INTERNAL_API_KEY, JWT_SECRET, CouchDB administrator credentials, and AWS keys, which become available to the attacker after exploitation. Obtaining CouchDB credentials enables direct access to the database, enumeration of databases for all tenants, and reading user records (including email addresses).

An attacker can execute arbitrary JavaScript code on the server (RCE), extract all sensitive environment secrets (API keys, JWT, CouchDB data, AWS keys), and gain full access to the databases of all tenants and the user data contained in them.

Budibase should be updated to version 3.30.4, which contains the fix. Users using Budibase Cloud should verify that the provider has deployed the update. Self-hosted instances do not require remedial action in connection with this vulnerability.

Budibase in Cloud version (SaaS) earlier than 3.30.4 — only the Budibase Cloud environment; self-hosted deployments are not vulnerable.