An unauthenticated attacker can trigger an automation that includes a Bash step via a public webhook endpoint in Budibase. The vulnerability allows the attacker to execute arbitrary shell commands with root privileges inside the container, which can compromise the entire server and data. The weakness is a command injection identified as CWE-78.

Budibase, the open‑source low‑code platform, is affected in all releases prior to version 3.33.4. The issue was fixed in release 3.33.4. No other vendors or products are listed.

The CVSS base score of 9.1 indicates a very high severity. Because the exposure is via a publicly reachable webhook and requires no authentication, exploitation is straightforward for any attacker who can reach the endpoint. The EPSS score is not available, and the vulnerability is not yet present in the CISA KEV catalog. The impact scope is the entire Budibase instance, as the compromised process runs with root privileges.