npm

@budibase/server

42 Total advisories

42 Vulnerabilities

0 Malware

Dependency scanning

Check whether @budibase/server is in your codebase

Corgea flags malicious and compromised dependencies with reachability analysis, so you fix the packages that actually run in your application instead of working through the whole lockfile.

@budibase/server

Vulnerabilities

Budibase authenticated arbitrary S3 signed upload URL issuance via `/api/attachments/:datasourceId/url`

Budibase: SSO OAuth2 Token Leakage via User Metadata Endpoints to Power-Role Users

Budibase: S3 presigned URL endpoint authorization regression in v3.39.4 allows BASIC users to obtain S3 PutObject presigned URLs

Budibase: SSRF in Automation Steps - Webhook, Zapier, N8N, Slack, Discord Bypass IP Blacklist

Budibase: DNS rebinding SSRF bypasses remain in OpenAPI import and REST query execution

Budibase: NoSQL Injection via JSON Parameter Interpolation in MongoDB Query Execution

Budibase: Chat-Link Handoff Identity Confusion (Same-Tenant Account-Link CSRF)

Budibase: NoSQL injection in MongoDB integration: collection dump, $where JS exec, cross-collection pivot, arbitrary update/delete

Budibase: MySQL DESCRIBE Backtick Injection via multipleStatements in Database Connector

Budibase: Unauthenticated REST Datasource Credential Theft via Cross-Origin Auth Leak

Budibase: Server Filesystem Existence/Read Oracle via Builder-Controlled MongoDB tlsCertificateKeyFile

Budibase: SSRF via DNS rebinding in the REST datasource integration

Budibase: OAuth2 Token Disclosure via Automation Test Results Broadcast to Other Builders

Budibase: SSRF via bare fetch() in uploadUrl during AI table generation

Budibase: Unauthenticated user information disclosure via public tenant user lookup endpoint

Budibase: SQL Injection via `multipleStatements: true`

Budibase: Account Enumeration via Login Lockout Response Differential

Budibase has nonymous NoSQL operator injection via published-app query templates

Budibase has arbitrary file read by workspace-builder via PWA-zip symlink upload

Budibase: Privilege escalation via public role assignment API missing app-level authorization

Budibase: OIDC SSO account takeover: incoming identity linked by email without checking email_verified

Budibase: Email Change IDOR via POST /api/v2/email allows full Account Takeover (accountId not validated against session)

Budibase: Missing RBAC on GET /api/global/groups allows BASIC users to enumerate all tenant groups and role mappings

Budibase has an Account Impersonation Issue — Chat Identity Link Hijacking via Missing Consent & CSRF

Budibase: Mass Assignment in Webhook Trigger Allows Cross-Workspace Automation Execution via appId Override

Budibase: POST /api/attachments/:datasourceId/url is unauthenticated and lets anonymous callers mint S3 PUT pre-signed URLs using stored datasource IAM credentials

Budibase: Unauthenticated S3 signed upload URL generation allows arbitrary writes with stored datasource credentials

Budibase: SSRF via OAuth2 token endpoint URL reaches internal hosts and cloud metadata

Budibase: Workspace-scoped builder escalates to global admin via /api/public/v1/roles/assign

Budibase: Unvalidated VectorDB Host Parameter Enables SSRF

Budibase: Webhook schema endpoint authorization bypass allows unauthenticated mutation of webhook and automation schema

Budibase: Basic app users can exfiltrate stored REST datasource auth by rewriting datasource base URL

Budibase: SSRF via OAuth2 Config Validation — Missing fetchWithBlacklist Protection

Budibase: SSRF in AI Extract File Automation Step via Missing IP Blacklist Validation

Budibase: `PUT /api/datasources/:datasourceId` is protected only by `TABLE/READ` permission instead of builder access, allowing any authenticated app user to overwrite datasource connection parameters including host, port, and URL

Budibase: CouchDB Reduce Injection via Unsanitized Calculation Parameter in V1 Views API

Budibase: SSRF Bypass via HTTP Redirect in REST Datasource Integration

Budibase: Command Injection in Bash Automation Step

Budibase: Unauthenticated Remote Code Execution via Webhook Trigger and Bash Automation Step

Budibase: Path traversal in plugin file upload enables arbitrary directory deletion and file write

@budibase/server: Command Injection in PostgreSQL Dump Command

Budibase affected by VM2 Constructor Escape Vulnerability

Browse more npm advisories

Start Securing