Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Budibase is a low code platform for creating internal tools, workflows, and admin panels. Prior to version 3.30.4, an unsafe `eval()` vulnerability in Budibase's view filtering implementation allows any authenticated user (including free tier accounts) to execute arbitrary JavaScript code on the server. This vulnerability ONLY affects Budibase Cloud (SaaS) - self-hosted deployments use native CouchDB views and are not vulnerable. The vulnerability exists in `packages/server/src/db/inMemoryView.ts` where user-controlled view map functions are directly evaluated without sanitization. The primary impact comes from what lives inside the pod's environment: the `app-service` pod runs with secrets baked into its environment variables, including `INTERNAL_API_KEY`, `JWT_SECRET`, CouchDB admin credentials, AWS keys, and more. Using the extracted CouchDB credentials, we verified direct database access, enumerated all tenant databases, and confirmed that user records (email addresses) are readable. Version 3.30.4 contains a patch.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-02-25 | 2 | Disclosure2 |
| 2026-02-26 | 1 | Patch1 |
| 2026-02-28 | 1 | Patch1 |
CVE-2026-27702 Budibase is a low code platform for creating internal tools, workflows, and admin panels. Prior to version 3.30.4, an unsafe `eval()` vulnerability in Budibase's view… https://www.cve.org/CVERecord?id=CVE-2026-27702
Post summary
Budibase’s unsafe eval() vulnerability (CVE-2026-27702) is addressed in version 3.30.4; no PoC, exploit code, or active exploitation is reported.
`Budibase` is affected by CVE-2026-27702, a Remote Code Execution vulnerability in its View Filter Map Function. Update to the patched version. #RCE #infosec https://www.pulsepatch.io/posts/cve-2026-27702-budibase-rce-eval
Post summary
Budibase is vulnerable to CVE-2026-27702, a remote code execution flaw in the View Filter Map Function; users are advised to update to the patched version.
🔴 CVE-2026-27702 - Critical Budibase is a low code platform for creating internal tools, workflows, and admin panels. Prior to version 3.30.4, an unsafe `eval()` vulnerability in Budibase's view filtering implementa... https://www.thehackerwire.com/vulnerability/CVE-2026-27702/ https://t.co/ow6IyPSFcV
Post summary
A critical unsafe eval() vulnerability (CVE-2026-27702) was disclosed in Budibase prior to version 3.30.4, with no mention of PoC, exploit, or patch.
CVE-2026-27702 pertains to a critical security flaw in **Budibase**, a low-code platform used for creating internal tools, workflows, and admin panels. The vulnerability exists in **Budibase Cloud (SaaS)** versions prior to 3.30.4 and involves an **unsafe `eval()`** operation within the view filtering implementation, specifically in the `packages/server/src/db/inMemoryView.ts` file. #Cybersecurity #CVE #CriticalCVE #CriticalVulnerability #RemoteCodeExecution #PrivilegeEscalation https://cvetodo.com/cve/CVE-2026-27702
Post summary
The post announces CVE‑2026‑27702 as a critical flaw in Budibase Cloud, detailing an unsafe eval() in view filtering that could enable remote code execution, but it does not provide a PoC, exploit, or patch information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | budibase | budibase | - | - | - |