The flaw lies in the bash automation step where user supplied commands are executed with execSync without sanitization. The interpreter processes template interpolation, allowing execution of arbitrary shell commands. Successful exploitation gives the attacker full control over the host system, leading to potential data theft, system compromise, and service disruption. The weakness is classified as CWE‑78 Command Injection.

The issue affects Budibase versions prior to 3.33.4. The low‑code platform is distributed as a community edition, and the vulnerability exists in the automation step module. Upgrading to 3.33.4 or later removes the vulnerable code path.

The CVSS score of 8.7 indicates high severity. EPSS data is not available, and the vulnerability is not listed in CISA's KEV catalog. The probable attack vector involves providing malicious input to the bash automation step, which is processed by processStringSync and then passed to execSync, enabling command execution. The vulnerability is likely to be exploitable in environments where the automation step is exposed to untrusted users.