CVE-2026-35216CWE-78command-injection

CVE-2026-35216

Critical · published April 3, 2026

CVSS v3.1
9.0
EPSS
1%
Percentile
67.1
In the wild
Unconfirmed
What it is

Budibase is an open-source low-code platform. Prior to version 3.33.4, an unauthenticated attacker can achieve Remote Code Execution (RCE) on the Budibase server by triggering an automation that contains a Bash step via the public webhook endpoint. No authentication is required to trigger the exploit. The process executes as root inside the container. This issue has been patched in version 3.33.4.

The record
Technical detail
CVSS v3.1
9.0 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01168 · 67.1th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-04-03T20:16Z
Affected products (1)
ProductVersionsFixed in
budibase/budibase< 3.33.43.33.4
References (5)
https://github.com/Budibase/budibase/commit/f0c731b409a96e401445a6a6030d2994ff4ac256 · [email protected]https://github.com/Budibase/budibase/pull/18238 · [email protected]https://github.com/Budibase/budibase/releases/tag/3.33.4 · [email protected]https://github.com/Budibase/budibase/security/advisories/GHSA-fcm4-4pj2-m5hf · [email protected]https://github.com/Budibase/budibase/security/advisories/GHSA-fcm4-4pj2-m5hf · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 03 APR 15:45Z
    Budibase: Unauthenticated Remote Code Execution via Webhook Trigger and Bash Automation Step
    cvelistv5