Budibase, an open‑source low‑code platform, suffered a command injection vulnerability in the bash automation step. The flaw lies in the use of execSync to run user supplied shell commands without proper sanitization. Because processStringSync performs template interpolation, an attacker can inject arbitrary shell commands and execute them with the privileges of the Budibase process.

All Budibase installations using versions earlier than 3.33.4 are vulnerable. The issue was addressed in release 3.33.4, which removes the unsafe execSync call and adds input validation.

The vulnerability scores a CVSS score of 8.7, indicating a high severity impact. EPSS is reported as less than 1%, suggesting that exploitation remains uncommon. The CVE is not listed in the CISA KEV catalog. The likely attack vector is through the application’s automation step where an authenticated user can supply a script; this route enables execution of arbitrary commands on the host hosting Budibase.