The vulnerability resides in the PostgreSQL integration of Budibase, where user‑controlled configuration values – such as database name, host, and password – are interpolated directly into a shell command without sanitization. This permits an attacker to inject malicious payloads, leading to arbitrary shell command execution on the host running the Budibase server. The potential impact includes full compromise of the affected system, data exfiltration, or disruption of services because the injected commands run with the privileges of the Budibase application process.

Budibase, the low‑code platform for internal tools and workflows. All releases up to and including 3.23.22 are affected; the flaw is located in packages/server/src/integrations/postgres.ts. Any deployment that uses PostgreSQL integration and accepts configuration values from users could be vulnerable.

The CVSS score of 8.6 indicates a high‑severity weakness. The EPSS score is below 1 %, suggesting low probability of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, the attack vector is likely remote if an attacker can influence the configuration parameters – for example, through a user‑provided UI, API or environment variables – and can thereby execute arbitrary shell commands on the server. The absence of a public fix at the time of this report highlights the need for immediate remediation to prevent potential compromise.