CVE-2026-82244General

LOWCVSS 9.4 · CRITICAL

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Budibase versions before 3.41.3 contain a remote code execution vulnerability in plugin handling that allows authenticated admin users to execute arbitrary code by uploading a malicious plugin tarball. The server calls eval() on plugin JavaScript files without sandboxing in the main Node.js process, enabling attackers to exfiltrate environment variables and credentials with root privileges in default deployments.

0.5/ 10 priority

Sources & remediation

Weakness type (CWE)
CWE-94

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Threat summary

  • Patch or workaround signal is available
  • 2 mentions across 1 observed day

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 2 signals
  • General: 1 classified signal
  • 2 total mentions across 1 day

Deep dive

Activity timeline2 mentions / 1d
01122Mentions · 2026-08-28: 2Patch / Workaround · 2026-08-28: 1Technical Details · 2026-08-28: 208-28
Signal classification2 categories
General
150.0%
Patch
150.0%
Referenced assets2 URLs
Full discourse2 posts
  • NewNormal Security@NewScanTeam
    General

    NewNormal Security turns the last 24 hours of CVEs into new detections, every day. 𝗗𝗮𝗶𝗹𝘆 𝗖𝗩𝗘 𝗥𝗲𝗽𝗼𝗿𝘁 — 28 Aug 2026 𝗔𝗱𝗱𝗲𝗱 to NewScan 𝘁𝗼𝗱𝗮𝘆: 🚨 Outdated ownCloud — WebDAV answers with no login, so a known username is enough to read or delete their files, or a leftover test file prints the admin password, as seen in ownCloud CVE-2023-49105, CVE-2023-49103 ⚡ Outdated Budibase — an uploaded plugin runs as code, and low-privilege users reach data and roles their app denies them, as seen in Budibase CVE-2026-82244, CVE-2026-82239, CVE-2026-82240, CVE-2026-82241, CVE-2026-82242, CVE-2026-82243, CVE-2026-82245, CVE-2026-82246 📦 FileBrowser with no maintainer left — a named pipe in a shared folder hangs downloads, and no fix will ever ship, as seen in FileBrowser CVE-2026-82235, CVE-2026-82237, CVE-2026-82238 Test your stack with NewScan — free, self-hosted: https://newnormalsecurity.com/newscan?utm_source=x&utm_medium=social&utm_campaign=daily-cve #infosec #AppSec #AuthBypass #CSO #REDTEAM

    Post summary

    The message is a daily CVE report listing known vulnerabilities in ownCloud, Budibase, and FileBrowser, providing technical exposure details but no exploits, PoC links or patch information.

    0000071
    6 followersView on X
  • Security Arsenal, LLC@SecurityAr58409
    Patch

    🔒 #CyberSecurity CVE-2026-82244: Budibase Plugin eval() Code Execution — Detection and Remediati… "NVD has published CVE-2026-82244, a critical vulnerability carrying a CVSS v3.1 score of…" 🔗 https://securityarsenal.com/blog/cve-2026-82244-budibase-plugin-eval-code-execution-detection-and-remediation-guide #CyberSecurity #ThreatIntel #cve202682244 #critical #cve

    Post summary

    The tweet references a critical CVE in Budibase, supplies a CVSS score, and directs readers to a remediation guide, but provides no evidence of exploitation or PoC code.

    0000043
    29 followersView on X

Explore more