CVE-2026-27702

Budibase is a low code platform for creating internal tools, workflows, and admin panels. Prior to version 3.30.4, an unsafe eval() vulnerability in Budibase's view filtering implementation allows any authenticated user (including free tier accounts) to execute arbitrary JavaScript code on the server. This vulnerability ONLY affects Budibase Cloud (SaaS) - self-hosted deployments use native CouchDB views and are not vulnerable. The vulnerability exists in packages/server/src/db/inMemoryView.ts where user-controlled view map functions are directly evaluated without sanitization. The primary impact comes from what lives inside the pod's environment: the app-service pod runs with secrets baked into its environment variables, including INTERNAL_API_KEY, JWT_SECRET, CouchDB admin credentials, AWS keys, and more. Using the extracted CouchDB credentials, we verified direct database access, enumerated all tenant databases, and confirmed that user records (email addresses) are readable. Version 3.30.4 contains a patch.

Budibase is a low code platform for creating internal tools, workflows, and admin panels. Prior to version 3.30.4, an unsafe eval() vulnerability in Budibase's view filtering implementation allows any authenticated user (including free tier accounts) to execute arbitrary JavaScript code on the server. This vulnerability ONLY affects Budibase Cloud (SaaS) - self-hosted deployments use native CouchDB views and are not vulnerable. The vulnerability exists in packages/server/src/db/inMemoryView.ts where user-controlled view map functions are directly evaluated without sanitization. The primary impact comes from what lives inside the pod's environment: the app-service pod runs with secrets baked into its environment variables, including INTERNAL_API_KEY, JWT_SECRET, CouchDB admin credentials, AWS keys, and more. Using the extracted CouchDB credentials, we verified direct database access, enumerated all tenant databases, and confirmed that user records (email addresses) are readable. Version 3.30.4 contains a patch.

Summary

A critical unsafe eval() vulnerability in Budibase's view filtering implementation allows any authenticated user (including free tier accounts) to execute arbitrary JavaScript code on the server. This vulnerability ONLY affects Budibase Cloud (SaaS) - self-hosted deployments use native CouchDB views and are not vulnerable. The vulnerability exists in packages/server/src/db/inMemoryView.ts where user-controlled view map functions are directly evaluated without sanitization.

The primary impact comes from what lives inside the pod's environment: the app-service pod runs with secrets baked into its environment variables, including INTERNAL_API_KEY, JWT_SECRET, CouchDB admin credentials, AWS keys, and more. Using the extracted CouchDB credentials, we verified direct database access, enumerated all tenant databases, and confirmed that user records (email addresses) are readable.

Details

Root Cause

File: packages/server/src/db/inMemoryView.ts:28

export async function runView(
  view: DBView,
  calculation: string,
  group: boolean,
  data: Row[]
) {
  // ...
  let fn = (doc: Document, emit: any) => emit(doc._id)
  // BUDI-7060 -> indirect eval call appears to cause issues in cloud
  eval("fn = " + view?.map?.replace("function (doc)", "function (doc, emit)"))  // UNSAFE EVAL
  // ...
}

Why Only Cloud is Vulnerable:

File: packages/server/src/sdk/workspace/rows/search/internal/internal.ts:194-221

if (env.SELF_HOSTED) {
  // Self-hosted: Uses native CouchDB design documents - NO EVAL
  response = await db.query(`database/${viewName}`, {
    include_docs: !calculation,
    group: !!group,
  })
} else {
  // Cloud: Uses in-memory PouchDB with UNSAFE EVAL
  const tableId = viewInfo.meta!.tableId
  const data = await fetchRaw(tableId!)
  response = await inMemoryViews.runView(  // <- Calls vulnerable function
    viewInfo,
    calculation as string,
    !!group,
    data
  )
}

The view.map parameter comes directly from user input when creating table views with filters. The code constructs a string by concatenating "fn = " with the user-controlled map function and passes it to eval(), allowing arbitrary JavaScript execution in the Node.js server context.

Self-hosted deployments are not affected because they use native CouchDB design documents instead of the in-memory eval() path.

Attack Flow

1. Authenticated user creates a table view with custom filter
2. Frontend sends POST request to /api/views with malicious payload in filter value
3. Backend stores view configuration in CouchDB
4. When view is queried (GET /api/views/{viewName}), runView() is called
5. Malicious code is eval()'d on server - RCE achieved

Exploitation Vector

The vulnerability is triggered via the view filter mechanism. When creating a view with a filter condition, the filter value can be injected with JavaScript code that breaks out of the intended expression context:

Malicious filter value:

x" || (MALICIOUS_CODE_HERE, true) || "

This payload:

• Closes the expected string context with x"
• Uses || (OR operator) to inject arbitrary code
• Returns true to make the filter always match
• Closes with || "" to maintain valid syntax

Verified on Production

Tested on own Budibase Cloud account (y4ylfy7m.budibase.app,) to confirm severity. Testing was deliberately limited - no customer data was retained and exploitation was stopped once impact was confirmed:

• Achieved RCE on app-service pod (hostname: app-service-5f4f6d796d-p6dhz, Kubernetes, eu-west-1)
• Extracted process.env - confirmed presence of platform secrets (JWT_SECRET, INTERNAL_API_KEY, COUCH_DB_URL, MINIO_ACCESS_KEY, etc.)
• Used extracted COUCH_DB_URL credentials to verify CouchDB access - enumerated database list (489,827 databases) to confirm scale of impact
• Queried users table to confirm data is readable (retrieved email addresses) -…

Budibase is a low code platform for creating internal tools, workflows, and admin panels. Prior to version 3.30.4, an unsafe eval() vulnerability in Budibase's view filtering implementation allows any authenticated user (including free tier accounts) to execute arbitrary JavaScript code on the server. This vulnerability ONLY affects Budibase Cloud (SaaS) - self-hosted deployments use native CouchDB views and are not vulnerable. The vulnerability exists in packages/server/src/db/inMemoryView.ts where user-controlled view map functions are directly evaluated without sanitization. The primary impact comes from what lives inside the pod's environment: the app-service pod runs with secrets baked into its environment variables, including INTERNAL_API_KEY, JWT_SECRET, CouchDB admin credentials, AWS keys, and more. Using the extracted CouchDB credentials, we verified direct database access, enumerated all tenant databases, and confirmed that user records (email addresses) are readable. Version 3.30.4 contains a patch.

Budibase is a low code platform for creating internal tools, workflows, and admin panels. Prior to version 3.30.4, an unsafe eval() vulnerability in Budibase's view filtering implementation allows any authenticated user (including free tier accounts) to execute arbitrary JavaScript code on the server. This vulnerability ONLY affects Budibase Cloud (SaaS) - self-hosted deployments use native CouchDB views and are not vulnerable. The vulnerability exists in packages/server/src/db/inMemoryView.ts where user-controlled view map functions are directly evaluated without sanitization. The primary impact comes from what lives inside the pod's environment: the app-service pod runs with secrets baked into its environment variables, including INTERNAL_API_KEY, JWT_SECRET, CouchDB admin credentials, AWS keys, and more. Using the extracted CouchDB credentials, we verified direct database access, enumerated all tenant databases, and confirmed that user records (email addresses) are readable. Version 3.30.4 contains a patch.

Summary

A critical unsafe eval() vulnerability in Budibase's view filtering implementation allows any authenticated user (including free tier accounts) to execute arbitrary JavaScript code on the server. This vulnerability ONLY affects Budibase Cloud (SaaS) - self-hosted deployments use native CouchDB views and are not vulnerable. The vulnerability exists in packages/server/src/db/inMemoryView.ts where user-controlled view map functions are directly evaluated without sanitization.

The primary impact comes from what lives inside the pod's environment: the app-service pod runs with secrets baked into its environment variables, including INTERNAL_API_KEY, JWT_SECRET, CouchDB admin credentials, AWS keys, and more. Using the extracted CouchDB credentials, we verified direct database access, enumerated all tenant databases, and confirmed that user records (email addresses) are readable.

Details

Root Cause

File: packages/server/src/db/inMemoryView.ts:28

export async function runView(
  view: DBView,
  calculation: string,
  group: boolean,
  data: Row[]
) {
  // ...
  let fn = (doc: Document, emit: any) => emit(doc._id)
  // BUDI-7060 -> indirect eval call appears to cause issues in cloud
  eval("fn = " + view?.map?.replace("function (doc)", "function (doc, emit)"))  // UNSAFE EVAL
  // ...
}

Why Only Cloud is Vulnerable:

File: packages/server/src/sdk/workspace/rows/search/internal/internal.ts:194-221

if (env.SELF_HOSTED) {
  // Self-hosted: Uses native CouchDB design documents - NO EVAL
  response = await db.query(`database/${viewName}`, {
    include_docs: !calculation,
    group: !!group,
  })
} else {
  // Cloud: Uses in-memory PouchDB with UNSAFE EVAL
  const tableId = viewInfo.meta!.tableId
  const data = await fetchRaw(tableId!)
  response = await inMemoryViews.runView(  // <- Calls vulnerable function
    viewInfo,
    calculation as string,
    !!group,
    data
  )
}

The view.map parameter comes directly from user input when creating table views with filters. The code constructs a string by concatenating "fn = " with the user-controlled map function and passes it to eval(), allowing arbitrary JavaScript execution in the Node.js server context.

Self-hosted deployments are not affected because they use native CouchDB design documents instead of the in-memory eval() path.

Attack Flow

1. Authenticated user creates a table view with custom filter
2. Frontend sends POST request to /api/views with malicious payload in filter value
3. Backend stores view configuration in CouchDB
4. When view is queried (GET /api/views/{viewName}), runView() is called
5. Malicious code is eval()'d on server - RCE achieved

Exploitation Vector

The vulnerability is triggered via the view filter mechanism. When creating a view with a filter condition, the filter value can be injected with JavaScript code that breaks out of the intended expression context:

Malicious filter value:

x" || (MALICIOUS_CODE_HERE, true) || "

This payload:

• Closes the expected string context with x"
• Uses || (OR operator) to inject arbitrary code
• Returns true to make the filter always match
• Closes with || "" to maintain valid syntax

Verified on Production

Tested on own Budibase Cloud account (y4ylfy7m.budibase.app,) to confirm severity. Testing was deliberately limited - no customer data was retained and exploitation was stopped once impact was confirmed:

• Achieved RCE on app-service pod (hostname: app-service-5f4f6d796d-p6dhz, Kubernetes, eu-west-1)
• Extracted process.env - confirmed presence of platform secrets (JWT_SECRET, INTERNAL_API_KEY, COUCH_DB_URL, MINIO_ACCESS_KEY, etc.)
• Used extracted COUCH_DB_URL credentials to verify CouchDB access - enumerated database list (489,827 databases) to confirm scale of impact
• Queried users table to confirm data is readable (retrieved email addresses) -…