CVE-2026-25044: Budibase: Command Injection in Bash Automation Step

Location: packages/server/src/automations/steps/bash.ts

Description The bash automation step executes user-provided commands using execSync without proper sanitization or validation. User input is processed through processStringSync which allows template interpolation, potentially allowing arbitrary command execution.

Code Reference 21:28:packages/server/src/automations/steps/bash.ts const command = processStringSync(inputs.code, context)

let stdout, success = true try { stdout = execSync(command, { timeout: environment.QUERYTHREADTIMEOUT, }).toString()

Attack Vector An attacker with access to create or modify automations can inject malicious shell commands by including template syntax that evaluates to command injection payloads (e.g., $(rm -rf /), ; malicious-command, | malicious-command).

Impact - Remote code execution (RCE) - Complete system compromise - Data exfiltration - Lateral movement within the infrastructure

Recommendation 1. Immediate: Disable bash automation step in production until fixed 2. Implement a whitelist of allowed commands 3. Use parameterized command execution with proper escaping 4. Implement command argument validation 5. Consider using a restricted shell or command sandboxing 6. Add rate limiting and monitoring for command execution

Example Fix typescript import { spawn } from "childprocess"

// Validate against whitelist const ALLOWEDCOMMANDS = ["echo", "date", "pwd"] // Extend as needed

function sanitizeCommand(input: string): string { // Remove dangerous characters and command chaining return input.replace(/[;&|$(){}[\]]/g, "").trim() }

function validateCommand(cmd: string): boolean { const parts = cmd.split(/\s+/) return ALLOWEDCOMMANDS.includes(parts[0]) }

export async function run({ inputs, context }) { if (!inputs.code) { return { stdout: "Budibase bash automation failed: Invalid inputs" } }

const processedCommand = processStringSync(inputs.code, context) const sanitized = sanitizeCommand(processedCommand) if (!validateCommand(sanitized)) { return { success: false, stdout: "Command not allowed" } }

// Use spawn instead of execSync with proper argument handling return new Promise((resolve) => { const [command, ...args] = sanitized.split(/\s+/) const proc = spawn(command, args, { timeout: environment.QUERYTHREADTIMEOUT, }) let stdout = "" proc.stdout.on("data", (data) => { stdout += data }) proc.on("close", (code) => { resolve({ stdout, success: code === 0 }) }) }) }