CVE-2026-73408: Budibase: MySQL DESCRIBE Backtick Injection via multipleStatements in Database Connector
Budibase is an open-source low-code platform. Prior to 3.39.18, packages/server/src/integrations/mysql.ts enabled multipleStatements and inserted an unescaped tableName into a DESCRIBE statement. An attacker able to create a MySQL table with a backtick and stacked statement in its name could wait for a Budibase administrator to run schema discovery, causing the second statement to execute. The fix applies quoteMySqlIdentifier before constructing the query. This issue is fixed in version 3.39.18.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Budibaseto a version that resolves this vulnerability.Fixed in 3.39.18 - Configuration
Upgrade to Budibase 3.39.18, where table identifiers in DESCRIBE are protected by applying quoteMySqlIdentifier before constructing the query (fixes unescaped tableName injection that could lead to stacked statement execution when multipleStatements is enabled prior to 3.39.18).
Budibase MySQL Database Connector (server/src/integrations/mysql.ts) multipleStatements = enabled (before 3.39.18)