CVE-2026-35218: Budibase: Stored XSS via unsanitized entity names rendered with {@html} in Builder Command Palette
Budibase is an open-source low-code platform. Prior to version 3.32.5, Budibase's Builder Command Palette renders entity names (tables, views, queries, automations) using Svelte's {@html} directive without any sanitization. An authenticated user with Builder access can create a table, automation, view, or query whose name contains an HTML payload (e.g. <img src=x onerror=alert(document.domain)>). When any Builder-role user in the same workspace opens the Command Palette (Ctrl+K), the payload executes in their browser, stealing their session cookie and enabling full account takeover. This issue has been patched in version 3.32.5.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-35218?
CVE-2026-35218 is classified as a high-severity vulnerability due to its potential for stored cross-site scripting (XSS) attacks.
How do I fix CVE-2026-35218?
To fix CVE-2026-35218, upgrade Budibase to version 3.32.5 or later, which addresses the XSS vulnerability.
What types of attacks can CVE-2026-35218 facilitate?
CVE-2026-35218 can facilitate stored cross-site scripting (XSS) attacks, allowing an attacker to execute arbitrary JavaScript in the context of a user's session.
Which versions of Budibase are affected by CVE-2026-35218?
Budibase versions prior to 3.32.5 are affected by CVE-2026-35218.
Can I mitigate CVE-2026-35218 without upgrading Budibase?
Mitigation for CVE-2026-35218 without upgrading is not recommended as the best practice is to apply the security update to prevent potential exploitation.