Vulnerability · Published Aug 13, 2026 · Assigned by GitHub_M

CVE-2026-73408Budibase: MySQL DESCRIBE Backtick Injection via multipleStatements in Database Connector

High 7.6

In plain English

A high-severity SQL injection in budibase from Budibase. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 39% of all known vulnerabilities).

Severity (CVSS 3.1)7.6High

Exploit odds (30 days)0.5%top 60.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Budibase is an open-source low-code platform. Prior to 3.39.18, packages/server/src/integrations/mysql.ts enabled multipleStatements and inserted an unescaped tableName into a DESCRIBE statement. An attacker able to create a MySQL table with a backtick and stacked statement in its name could wait for a Budibase administrator to run schema discovery, causing the second statement to execute. The fix applies quoteMySqlIdentifier before constructing the query. This issue is fixed in version 3.39.18.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	@budibase/server	no fix listed	GHSA-2xgg-r2wc-c5r2

Affected products (as reported)

Vendor	Product	Versions
Budibase	budibase	< 3.39.18

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H

References

https://github.com/Budibase/budibase/security/advisories/GHSA-2xgg-r2wc-c5r2 x_refsource_CONFIRM
https://github.com/Budibase/budibase/pull/18989 x_refsource_MISC
https://github.com/Budibase/budibase/commit/d232bd92144c768884ff8c48cb2e28673d9ffde0 x_refsource_MISC
https://github.com/Budibase/budibase/releases/tag/3.39.18 x_refsource_MISC