The vulnerability arises because Budibase’s V1 Views API naively interpolates a calculation parameter into a CouchDB reduce function without validating it against the defined schema map. This lack of validation permits a malicious payload that is treated as JavaScript code by the CouchDB engine. An attacker who can send a POST to /api/views with a crafted calculation value can cause arbitrary JavaScript execution inside the database on any query of that view, leading to full compromise of the database instance. The flaw is a classic injection flaw (CWE‑94).

Budibase, the open‑source low‑code platform, is affected in all releases prior to 3.38.1. No further version details are supplied beyond the stated fixed release. Users running older Budibase installations must verify that the calculation parameter is no longer interpolated directly into the reduce function.

The CVSS score of 6.5 indicates a moderate severity. The EPSS score is not available, so the current exploitation likelihood cannot be quantified from the data. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires a user with Builder permissions to construct a malicious POST to the Views API; therefore the attack vector is a legitimate API call within an authenticated session. Because the flaw is a code injection into the database’s JavaScript environment, any successful exploitation would grant an attacker complete control over the database and potentially the host. Stakeholders should treat this as a high‑risk situation where an internal attacker could compromise system integrity.