The vulnerability resides in the PostgreSQL datasource connector of Budibase, where the schema configuration supplied by an administrator is interpolated directly into a SET search_path statement without escaping embedded double quotes. This omission permits the execution of arbitrary SQL through the simple query protocol when an authenticated administrator saves or tests a datasource. The result is a classic SQL injection that can compromise data confidentiality, integrity, and availability.

Budibase, all versions prior to 3.39.19 are affected. An authenticated administrator must have the ability to edit or test datasource configurations for this flaw to be exploitable.

The flaw carries a CVSS score of 8.4 and is not listed as a known exploited vulnerability in CISA's KEV catalog. Because exploitation requires authenticated administrative access, the attack vector is likely restricted to administrators who have configuration rights. The lack of an EPSS score suggests no immediate exploitation data is available, but the high severity indicates a significant risk if an administrator inadvertently or maliciously inputs malicious schema data.