An unauthenticated attacker can exploit a flaw in the Budibase platform by triggering a public webhook that initiates an automation with a Bash step. The resulting shell command is executed with root privileges inside the container, allowing the attacker to run arbitrary code on the host. This gives full control over the server, compromising confidentiality, integrity, and availability of all data and services managed by Budibase.

Budibase low‑code platform, all installations running a version prior to 3.33.4. No specific sub‑components are listed, but the vulnerability affects the core automation engine that processes webhook requests.

The vulnerability scores a CVSS of 9.1, indicating critical severity. The EPSS shows an exploitation probability of less than 1%, and the issue is not listed in the CISA KEV catalog. Attackers do not need authentication and can trigger the exploit through any exposed webhook endpoint, making the attack vector straightforward and likely to succeed if the endpoint is publicly reachable.