Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Budibase is a low code platform for creating internal tools, workflows, and admin panels. In 3.23.22 and earlier, the PostgreSQL integration constructs shell commands using user-controlled configuration values (database name, host, password, etc.) without proper sanitization. The password and other connection parameters are directly interpolated into a shell command. This affects packages/server/src/integrations/postgres.ts.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-25041 Shell Command Injection in Budibase PostgreSQL Integration Version 3.23.22 and Earlier https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-25041
Post summary
The text references CVE-2026-25041, describing a shell command injection vulnerability in Budibase PostgreSQL Integration before v3.23.22. No exploit proof, active usage, patches, or debunking information is provided.
CVE-2026-25041 Budibase is a low code platform for creating internal tools, workflows, and admin panels. In 3.23.22 and earlier, the PostgreSQL integration constructs shell commands… https://www.cve.org/CVERecord?id=CVE-2026-25041
Post summary
The text discloses CVE‑2026‑25041, noting a shell command construction flaw in Budibase’s PostgreSQL integration, but provides no PoC, exploit, patch, or active exploitation details.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | budibase | budibase | - | - | - |