CVE-2026-64657CWE-89sql-injection

CVE-2026-64657

High · published August 18, 2026

CVSS v3.1

8.4

EPSS

Percentile

37.7

In the wild

Unconfirmed

What it is

Budibase is an open-source low-code platform. Prior to 3.39.19, the PostgreSQL datasource connector in packages/server/src/integrations/postgres.ts interpolates the user-controlled schema configuration field into a SET search_path statement without escaping embedded double quotes, allowing an authenticated administrator who saves or tests the datasource to execute arbitrary SQL through the simple query protocol. This issue is fixed in version 3.39.19.

The record

Technical detail

CVSS v3.1: 8.4 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
CVSS v4.0: Not supplied
EPSS: 0.00446 · 37.7th percentile
Weakness: CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published: 2026-08-18T01:16Z

References (3)

https://github.com/Budibase/budibase/commit/67572a82c3850964f388bfd969779dc025a80224 · [email protected]https://github.com/Budibase/budibase/security/advisories/GHSA-qqf5-x7mj-v43p · [email protected]https://github.com/Budibase/budibase/security/advisories/GHSA-qqf5-x7mj-v43p · 134c704f-9b21-4f2e-91b3-4a467353bcc0

EPSS history

Timeline

17 AUG 20:24Z
Budibase: Database Connector SQL Injections in PostgreSQL, MS SQL, and MySQL
cvelistv5