Vulnerability · Published Apr 3, 2026 · Assigned by GitHub_M

CVE-2026-35216Budibase: Unauthenticated Remote Code Execution via Webhook Trigger and Bash Automation Step

Critical 9.1

In plain English

A critical-severity OS command injection in budibase from Budibase. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 10.9% (higher than 96% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.1Critical

Exploit odds (30 days)10.9%top 4.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Budibase is an open-source low-code platform. Prior to version 3.33.4, an unauthenticated attacker can achieve Remote Code Execution (RCE) on the Budibase server by triggering an automation that contains a Bash step via the public webhook endpoint. No authentication is required to trigger the exploit. The process executes as root inside the container. This issue has been patched in version 3.33.4.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	@budibase/server	3.33.4	GHSA-fcm4-4pj2-m5hf

Affected products (as reported)

Vendor	Product	Versions
Budibase	budibase	< 3.33.4

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

References

https://github.com/Budibase/budibase/security/advisories/GHSA-fcm4-4pj2-m5hf x_refsource_CONFIRM
https://github.com/Budibase/budibase/pull/18238 x_refsource_MISC
https://github.com/Budibase/budibase/commit/f0c731b409a96e401445a6a6030d2994ff4ac256 x_refsource_MISC
https://github.com/Budibase/budibase/releases/tag/3.33.4 x_refsource_MISC