CVE-2026-82244: Budibase before 3.41.3 Remote Code Execution via Plugin eval()
Budibase versions before 3.41.3 contain a remote code execution vulnerability in plugin handling that allows authenticated admin users to execute arbitrary code by uploading a malicious plugin tarball. The server calls eval() on plugin JavaScript files without sandboxing in the main Node.js process, enabling attackers to exfiltrate environment variables and credentials with root privileges in default deployments.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Budibaseto a version that resolves this vulnerability.Fixed in 3.41.3 - Compensating control
Until upgraded, restrict authenticated admin access so only trusted users can access plugin upload/management functionality.
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An authenticated Budibase administrator who can upload a malicious plugin tarball can exploit it. Network access alone is not sufficient; the attacker needs administrative privileges.
Are default deployments at risk of privilege escalation beyond the Budibase process?
Yes. In default deployments, malicious plugin code executes in the main Node.js process and can access environment variables and credentials with root privileges.
What version resolves the issue?
Upgrade Budibase to version 3.41.3 or later. Versions before 3.41.3 are affected.
What can be done if upgrading is not immediately possible?
Restrict Budibase administrative access and prevent untrusted administrators from uploading plugins. Treat existing administrator accounts and plugin upload capability as high-risk because uploaded plugin JavaScript is evaluated without sandboxing.