Budibase's Text component renders markdown directly to innerHTML without sanitization, creating a stored cross‑site scripting sink. Any BASIC user with WRITE authorization on the underlying table can store malicious markdown that, when rendered in the back‑office, executes JavaScript within the context of an admin session. This flaw permits arbitrary code execution, compromising confidentiality, integrity, and availability of the application.

Budibase, version 3.38.x and earlier, including the open‑source Low‑Code platform’s Text component used in markdown mode. All apps deploying this component are affected, particularly those exposing WRITE access to BASIC users.

The vulnerability receives a CVSS score of 8.1, indicating a high‑severity flaw. EPSS data is unavailable and it is not listed in CISA’s KEV catalog. Attackers only need local data‑write privilege to an affected table column; once malicious markdown is stored, the code is rendered during subsequent view rendering with full admin privileges. The exploit relies on the application’s lack of input sanitization, not on network exposure or external conditions, making the attack vector straightforward for a user with the required permissions.