Budibase renders entity names—such as tables, views, queries, and automations—directly into the Builder Command Palette using Svelte's {@html} directive without sanitization. If a malicious user embeds HTML or JavaScript in an entity's name, the code executes client‑side whenever any Builder‑role user opens the palette, allowing theft of session cookies and full account takeover. This flaw corresponds to CWE‑79, a stored cross‑site scripting vulnerability.

Budibase is the affected product. All installations running a version earlier than 3.32.5 are vulnerable, as the patch was introduced in 3.32.5 and later releases. Any workspace hostable entity whose name contains user‑controlled content may trigger the flaw.

The recorded CVSS score is 8.7, indicating high severity. However, the EPSS score is below 1%, suggesting a low probability of exploitation in the wild, and the flaw is not listed in CISA's Known Exploited Vulnerabilities catalog. Attackers must be authenticated with Builder privileges and must create or modify an entity name in a shared workspace; any member with Builder access who then opens the palette will be affected. No additional disclosure or exploitation prerequisites are indicated beyond those in the description.