CVE-2026-100683 Details
Description
Budibase (@budibase/server) before 3.45.0 builds MySQL and MSSQL column-rename DDL in packages/backend-core/src/sql/sqlTable.ts by interpolating identifiers directly into a raw query string (backtick-quoted for MySQL, a single-quoted sp_rename literal for MSSQL) without applying the project's quoteMySqlIdentifier / quoteSqlServerIdentifier helpers. An attacker with DDL rights on a connected MySQL/MSSQL datasource can create a column whose name contains a backtick (MySQL) or single quote (MSSQL) plus additional SQL; Budibase's schema introspection stores the name verbatim, and when a Budibase builder later renames that column through the UI (POST /api/tables with _rename.old), the embedded quote character terminates the identifier and the injected SQL is executed. Because the MySQL connection is opened with multipleStatements: true, stacked statements run as Budibase's datasource user, allowing arbitrary reads, writes, or destructive operations on the connected database outside Budibase's row/table permission model. Fixed in 3.45.0.
A SQL injection vulnerability has been identified in Budibase server versions prior to 3.45.0. The issue arises in the SQL query builder, specifically within the column-rename DDL for MySQL and MSSQL databases. The vulnerability is created by directly interpolating column names into a raw query string without using the appropriate quoting helpers. This oversight allows an attacker with DDL rights on a connected database to inject additional SQL commands by crafting a column name that includes a backtick or single quote, depending on the database. When the column is renamed through the Budibase UI, the injected SQL is executed, leading to arbitrary SQL execution on the database as the Budibase datasource user.
Users should update Budibase to version 3.45.0 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 26, 2026CISA-ADP
Assessed Sep 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Budibase/budibase/security/advisories/GHSA-ppj8-hmx2-m546 | CISA-ADP | AdvisoryTechnical AnalysisVendor |
| https://github.com/Budibase/budibase/security/advisories/GHSA-ppj8-hmx2-m546 | [email protected] | AdvisoryTechnical AnalysisVendor |
| https://www.vulncheck.com/advisories/budibase-before-3.45.0-sql-injection-via-column-rename-ddl | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Budibase | <= 3.42.0 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 8, 2026 | CVE Modified | [email protected] |
| Sep 28, 2026 | CVE Modified | CISA-ADP |
| Sep 26, 2026 | New CVE Received | [email protected] |