CVE-2026-82244

Budibase versions before 3.41.3 allow authenticated admins to execute arbitrary code via unvalidated plugin uploads.

The vulnerability stems from the server calling eval() on plugin JavaScript files without sandboxing, enabling attackers to exfiltrate environment variables and credentials with root privileges in default deployments. DIB organizations must ensure their low-code platforms are patched to 3.41.3 or later to prevent remote code execution and credential theft.

Shame score — The use of eval() without sandboxing in a low-code platform is a severe, avoidable design flaw that directly enables remote code execution and credential exfiltration.