Budibase before version 3.40.0 is vulnerable to a NoSQL injection flaw in the MongoDB datasource integration. Because user‑supplied parameters are processed with handlebars using `noEscaping: true` and no operator filtering is applied, attackers can embed MongoDB operators directly into query parameters. This allows them to bypass per‑user access controls, read arbitrary documents, carry out arbitrary JavaScript execution via the `$where` operator, or perform update and delete operations on collections. The weakness is identified as CWE‑943, a class of misconfiguration or incorrect filter use that permits injection of privileged operators into a NoSQL query.

Budibase Server, all releases prior to 3.40.0 are affected. The vulnerability is present in the MongoDB datasource component used by the server. No alternative product versions or vendor patches are listed in the current dataset.

The CVSS score of 7.1 indicates a high impact vulnerability, while the EPSS score is not available, so the current data does not quantify exploitation likelihood. The vulnerability is not listed in CISA’s KEV catalog. Attackers can exploit the flaw remotely by supplying malicious query parameters to API endpoints that forward requests to MongoDB, assuming they can interact with the application, either authenticated or unauthenticated. Upon successful exploitation, an attacker can read confidential data, modify or delete it, and potentially execute arbitrary JavaScript code within the database context. The lack of operator filtering and the use of a no‑escape handlebars mode create a straightforward exploitation path with moderate effort.