The vulnerability is an SQL injection flaw introduced in Budibase ([budibase/server] before 3.45.0) where column rename DDL statements are assembled by directly interpolating identifier names into raw SQL strings without proper quoting. This flaw allows a user who holds DDL permissions on the connected MySQL or Microsoft SQL Server data source to craft a column name containing a backtick or single quote that terminates the identifier and injects arbitrary SQL. When that column is later renamed via the Budibase UI, the injected SQL is executed as the data‑source user, enabling unauthorized reads, writes, or destructive operations on the database beyond the application’s own permission model. The weakness is a classic SQL injection (CWE‑89).

Budibase Server versions earlier than 3.45.0 are affected. The problem exists in the backend core module responsible for database schema introspection and column renaming, and specifically impacts deployments that use MySQL or Microsoft SQL Server as the data source.

The CVSS score of 8.9 classifies the flaw as high severity, and although its EPSS score is not publicly available, the fact that it is not listed in the CISA KEV catalog indicates it is not a known widespread exploitation. The attack requires a user with DDL rights to create a column with a malicious name; the injected SQL is then executed when the column is renamed through the UI. Because the database connection is established with multipleStatements enabled, all stacked statements run as the data‑source user, magnifying the impact. Thus the exploitation likelihood is limited to environments where such privileged database users exist, but the potential damage to the underlying database is significant.