CVE-2026-27702

{"id": "CVE-2026-27702", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-27702", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-02-25T20:43:20.935389Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.9, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 3.1}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.0, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.3}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "Budibase", "product": "budibase", "versions": [{"status": "affected", "version": "< 3.30.4"}]}]}], "published": "2026-02-25T16:23:26.777", "references": [{"url": "https://github.com/Budibase/budibase/commit/348659810cf930dda5f669e782706594c547115d", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/Budibase/budibase/pull/18087", "tags": ["Issue Tracking"], "source": "security-advisories@github.com"}, {"url": "https://github.com/Budibase/budibase/releases/tag/3.30.4", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/Budibase/budibase/security/advisories/GHSA-rvhr-26g4-p2r8", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-94"}, {"lang": "en", "value": "CWE-95"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "Budibase is a low code platform for creating internal tools, workflows, and admin panels. Prior to version 3.30.4, an unsafe `eval()` vulnerability in Budibase's view filtering implementation allows any authenticated user (including free tier accounts) to execute arbitrary JavaScript code on the server. This vulnerability ONLY affects Budibase Cloud (SaaS) - self-hosted deployments use native CouchDB views and are not vulnerable. The vulnerability exists in `packages/server/src/db/inMemoryView.ts` where user-controlled view map functions are directly evaluated without sanitization. The primary impact comes from what lives inside the pod's environment: the `app-service` pod runs with secrets baked into its environment variables, including `INTERNAL_API_KEY`, `JWT_SECRET`, CouchDB admin credentials, AWS keys, and more. Using the extracted CouchDB credentials, we verified direct database access, enumerated all tenant databases, and confirmed that user records (email addresses) are readable. Version 3.30.4 contains a patch."}, {"lang": "es", "value": "Budibase es una plataforma de bajo c\u00f3digo para crear herramientas internas, flujos de trabajo y paneles de administraci\u00f3n. Antes de la versi\u00f3n 3.30.4, una `vulnerabilidad` `eval()` insegura en la implementaci\u00f3n de filtrado de vistas de Budibase permite a cualquier usuario autenticado (incluidas las cuentas de nivel gratuito) ejecutar c\u00f3digo JavaScript arbitrario en el `servidor`. Esta `vulnerabilidad` SOLO afecta a Budibase Cloud (SaaS) - las implementaciones autoalojadas usan vistas nativas de CouchDB y no son `vulnerables`. La `vulnerabilidad` existe en `packages/server/src/db/inMemoryView.ts` donde las funciones de mapeo de vistas controladas por el usuario se eval\u00faan directamente sin sanitizaci\u00f3n. El `impacto` principal proviene de lo que reside dentro del entorno del pod: el pod `app-service` se ejecuta con secretos incorporados en sus variables de entorno, incluyendo `INTERNAL_API_KEY`, `JWT_SECRET`, credenciales de administrador de CouchDB, claves de AWS y m\u00e1s. Usando las credenciales de CouchDB extra\u00eddas, verificamos el acceso directo a la `base de datos`, enumeramos todas las `bases de datos` de inquilinos, y confirmamos que los registros de usuario (direcciones de correo electr\u00f3nico) son legibles. La versi\u00f3n 3.30.4 contiene un `parche`."}], "lastModified": "2026-06-17T10:27:32.633", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:budibase:budibase:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6366022F-080A-40DB-B1E9-CD5811BED55D", "versionEndExcluding": "3.30.4"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}