An unauthenticated attacker can exploit a flaw in Budibase by triggering a public webhook that initiates an automation containing a Bash step. The resulting shell command runs with root privileges inside the container, enabling the attacker to execute arbitrary code on the host. This yields full control over the server, compromising confidentiality, integrity, and availability of all data and services managed by Budibase.

Budibase low‑code platform, all installations running a version prior to 3.33.4. No specific sub‑components are listed, but the vulnerability affects the core automation engine that processes webhook requests.

The vulnerability scores a CVSS of 9.1, indicating critical severity. The EPSS score of 12% suggests a moderate likelihood of exploitation, and the issue is not listed in the CISA KEV catalog. Attackers do not need authentication and can trigger the exploit through any exposed webhook endpoint, making the attack vector straightforward and likely to succeed if the endpoint is publicly reachable.