An unsafe use of eval() in Budibase’s view filtering implementation allows an authenticated user to execute arbitrary JavaScript on the server. Because the eval() call evaluates user‑controlled map functions with no sanitization, a malicious actor can run code with the same privileges as the app‑service pod, exposing internal secrets and database credentials. This can ultimately compromise the entire deployment, including user data, API keys, and other sensitive information.

Budibase servers that run the Budibase Cloud (SaaS) offering and use software versions prior to 3.30.4 are vulnerable. Self‑hosted deployments are not affected because they rely on native CouchDB views, which are not processed by the vulnerable component. Any SaaS instance where the app‑service runs with environment variables containing secrets such as INTERNAL_API_KEY, JWT_SECRET, CouchDB admin credentials, and AWS keys is at risk.

The CVSS score of 9.9 reflects a high‑severity remote code execution vulnerability that requires only authentication. The EPSS score of < 1% indicates that current exploitation attempts are rare, yet the impact of a successful exploit is substantial, providing full server compromise and data exfiltration. Because the vulnerability is not listed in the KEV catalog, there is no trace of widespread use, but the presence of privileged secrets in the pod’s environment makes exploitation extremely valuable to attackers. Attackers can trigger the flaw by crafting a malicious view filter through the cloud interface, requiring only valid user credentials.