Budibase, an open‑source low‑code platform, contains a NoSQL operator injection flaw that allows an unauthenticated visitor of any published application to inject crafted parameter values into raw JSON query bodies. The vulnerability arises because the platform substitutes user supplied values directly into the JSON body, only stripping Handlebars markers but not escaping JSON metacharacters. An attacker can append a closing quote followed by additional keys, causing the injected keys to become part of the parsed filter object. For MongoDB, the resulting filter is passed straight to collection.find() or updateMany(), which, when combined with a duplicate‑key override (for example, {"name":{$exists:true}} replacing a builder supplied name), results in every document in the target collection being returned or modified. The effect is a full compromise of confidentiality and integrity for all data stored in the underlying database, spanning MongoDB, CouchDB, Elasticsearch, DynamoDB PartiQL, or REST‑with‑JSON‑body collections.

Budibase version releases prior to 3.39.12, as distributed by the Budibase: budibase product, are affected. Any published Budibase application that exposes a PUBLIC read or write query, regardless of the underlying NoSQL backend, is vulnerable. The fix is included in Budibase 3.39.12; users must upgrade to that version or later.

The CVSS score is 10, indicating a critical severity. The EPSS score is not available, but the vulnerability is not currently listed in the CISA Known Exploit Vulnerabilities catalog. The attacker requires only the public application ID header and a crafted HTTP POST to /api/v2/queries/:queryId; no authentication or proper CSRF protection is enforced. Consequently, the attack can be performed from any network with access to the public endpoint, making exploitation trivially feasible.