The vulnerability occurs when Budibase Server executes plugin JavaScript files using eval() without any sandboxing. An authenticated administrator can upload a malicious plugin tarball that contains code executed in the main Node.js process; this allows arbitrary code execution. Because the default deployment runs the Node.js process with root privileges, the attacker can read environment variables and credentials, enabling full system compromise.

Budibase Server versions prior to 3.41.3 are affected. No specific further sub‑version details are provided beyond the pre‑3.41.3 range.

The CVSS score is 9.4, indicating critical severity. The EPSS score is not available, and the vulnerability is not listed in CISA KEV. The flaw requires an authenticated administrator to upload a plugin, but once access is achieved the attacker can execute arbitrary code with root privileges. The lack of sandboxing and the full process privileges make this highly exploitable once the initial credential compromise occurs.