Budibase’s MySQL connector allowed the execution of multiple statements and inserted the table name directly into a DESCRIBE statement without proper escaping. An attacker who could create a table whose name contains a backtick and an appended SQL fragment would cause the connector to run a second, unintended statement when an administrator performed schema discovery. This flaw permits execution of arbitrary SQL commands, potentially allowing data exfiltration, modification, or other database tampering, as reflected by its classification as a CWE‑89 SQL Injection issue.

The vulnerability exists in the Budibase low‑code platform prior to release 3.39.18. Anyone running Budibase version 3.39.17 or earlier is exposed when the MySQL connector uses the multipleStatements option and the administrator performs a schema discovery operation. Upgrading to 3.39.18 or later removes the vulnerable code.

With a CVSS score of 7.6, the issue is considered high severity. The EPSS score is currently unavailable, so the present exploitation probability is unknown, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack path requires an attacker to supply a crafted table name and to rely on an administrative action that triggers the dangerous DESCRIBE query. While not trivially exploitable from a remote network location, any administrative access to the Budibase instance or the ability to influence table creation substantially raises the risk of unintended statement execution.