Budibase versions prior to 3.39.19 contain an SQL injection flaw that may allow an administrative user to compromise the underlying database system.

The application fails to properly neutralize special elements used in SQL commands. The vulnerability requires high privileges (authenticated administrator) and user interaction, which limits the attack surface but poses a high risk to database integrity.

Successful exploitation of this SQL injection vulnerability could lead to unauthorized data access, modification, or deletion within the connected database. With a CVSS score of 8.4, this vulnerability represents a significant risk to the confidentiality and integrity of sensitive business information managed by the platform.

Immediate Action: Update the Budibase installation to version 3.39.19 or higher to resolve the database input sanitization issue.

Proactive Monitoring: Review database audit logs for anomalous queries, such as unexpected administrative commands or large volume data exports that do not align with normal operational tasks.

Compensating Controls: Implement strict database access controls and use prepared statements where possible to minimize the impact of potential injection flaws.

Public Exploit Available: Unknown

Organizations should treat this as a high-priority update. Ensure that all administrative accounts are secured and that the platform is upgraded immediately to eliminate the risk of database compromise.