CVE-2026-48149: Budibase: Stored XSS in Text component: BASIC users execute JS in admin session via MarkdownViewer innerHTML + CDN+srcdoc CSP bypass
Budibase is an open-source low-code platform. Prior to 3.39.0, the Budibase Text component renders markdown by assigning marked.parse(markdown) straight to innerHTML with no sanitizer (packages/bbui/src/Markdown/MarkdownViewer.svelte:22). Any column a builder binds to a Text component in Markdown mode is a stored-XSS sink writable by every BASIC app user with WRITE on the underlying table. This vulnerability is fixed in 3.39.0.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-48149?
CVE-2026-48149 has a high severity rating of 8.1.
What type of vulnerability is CVE-2026-48149?
CVE-2026-48149 is a stored Cross-Site Scripting (XSS) vulnerability.
How do I fix CVE-2026-48149?
To fix CVE-2026-48149, update Budibase to version 3.39.0 or later.
Who is affected by CVE-2026-48149?
CVE-2026-48149 affects users of the Budibase platform using the Text component before version 3.39.0.
What is the impact of CVE-2026-48149?
CVE-2026-48149 allows BASIC users to execute JavaScript within admin sessions, posing a significant security risk.