CVE-2026-82244 — Budibase before 3.41.3 Remote Code Execution via Plugin eval()
Budibase versions before 3.41.3 contain a remote code execution vulnerability in plugin handling that allows authenticated admin users to execute arbitrary code by uploading a m…
Published: 2026-08-28 · CVSS: 9.4 · CVSS 4.0
Budibase versions before 3.41.3 contain a remote code execution vulnerability in plugin handling that allows authenticated admin users to execute arbitrary code by uploading a malicious plugin tarball. The server calls eval() on plugin JavaScript files without sandboxing in the main Node.js process, enabling attackers to exfiltrate environment variables and credentials with root privileges in default deployments.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7