A critical remote code execution flaw in Budibase versions before 3.41.3 lets authenticated admin users run arbitrary code by uploading a malicious plugin tarball.
What Is It
CVE-2026-82244 is a code injection vulnerability (CWE-94) in Budibase's plugin handling. The server calls eval() on plugin JavaScript files without sandboxing, executing the code directly in the main Node.js process. An authenticated admin user who uploads a crafted plugin tarball gains arbitrary code execution on the host.
The flaw carries a CVSS 3.1 base score of 9.1 (CRITICAL): vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. A secondary CVSS 4.0 score of 9.4 (CRITICAL) was also assigned. The record was published 2026-08-28 by VulnCheck.
Why It Matters
Because plugin code runs unsandboxed in the main Node.js process, an attacker can exfiltrate environment variables and credentials. The advisory states that default deployments run that process with root privileges; where that holds, the impact extends beyond the application itself; consistent with the CVSS scope-changed rating (S:C) and high confidentiality, integrity, and availability impact to both the vulnerable component and downstream systems.
The attack requires high privileges (an admin account) and no user interaction, and is reachable over the network with low complexity. That makes it a strong post-compromise escalation path: a stolen or abused admin session converts directly into host-level code execution and credential theft.
There is no CISA KEV entry for this CVE in the supplied data, and exploit maturity is listed as NOT_DEFINED, no confirmation of active exploitation.
What's Vulnerable
- Vendor/product: Budibase,
server(pkg:npm/budibase/server) - Affected: all versions before 3.41.3 (semver)
- Unaffected: 3.41.3 and later
Per the advisory, default deployments run with root privileges, which would increase exposure where that configuration is in use.
Patch Status
Fixed in Budibase 3.41.3. Upgrade to 3.41.3 or later. No workaround is described in the supplied source material, and no CISA KEV required-action or due date applies.
Sources
- GitHub Security Advisory GHSA-gwr2-pgg3-p7xp; https://github.com/Budibase/budibase/security/advisories/GHSA-gwr2-pgg3-p7xp
- VulnCheck Advisory; https://www.vulncheck.com/advisories/budibase-before-3.41.3-remote-code-execution-via-plugin-eval