CVE-2026-73408

HIGH 7.6

Budibase: MySQL DESCRIBE Backtick Injection via multipleStatements in Database Connector

CVSS Score

7.6

EPSS Score

0.0%

EPSS Percentile

0th

Budibase is an open-source low-code platform. Prior to 3.39.18, packages/server/src/integrations/mysql.ts enabled multipleStatements and inserted an unescaped tableName into a DESCRIBE statement. An attacker able to create a MySQL table with a backtick and stacked statement in its name could wait for a Budibase administrator to run schema discovery, causing the second statement to execute. The fix applies quoteMySqlIdentifier before constructing the query. This issue is fixed in version 3.39.18.

CWE	CWE-89
Vendor	budibase
Product	budibase
Published	Aug 13, 2026

Stay Ahead of the Next One

Get instant alerts for budibase budibase

Be the first to know when new high vulnerabilities affecting budibase budibase are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

Budibase / budibase

< 3.39.18

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/Budibase/budibase/security/advisories/GHSA-2xgg-r2wc-c5r2 github.com: https://github.com/Budibase/budibase/pull/18989 github.com: https://github.com/Budibase/budibase/commit/d232bd92144c768884ff8c48cb2e28673d9ffde0 github.com: https://github.com/Budibase/budibase/releases/tag/3.39.18