CVE-2026-27702 is a critical flaw (CVSS 9.9) in Budibase. User controlled view map functions are run through eval(), so any signed in user on Budibase Cloud could run code on the server. Self-hosted deployments are not affected, and the record lists 3.30.4 as the fix.
What's affected
The record says Budibase before 3.30.4 is affected, but only the Budibase Cloud SaaS service. The advisory states that self-hosted deployments use native CouchDB views and are not vulnerable.
That means two groups of readers. If you self-host Budibase, this specific flaw does not apply to you, though you should still keep the platform current. If you are a Budibase Cloud customer, the service is operated by the vendor, so the main questions are what the vendor has said about the fix and what data was reachable.
The GitHub advisory page, as fetched, shows affected versions up to 3.30.3 and no patched version listed, while the record and a release both name 3.30.4. Trust the fixed version in the record and release, and read the advisory for updates.
How to check if you're exposed
Self-hosted: confirm that your deployment really runs in self-hosted mode. The advisory says the vulnerable code path is chosen by whether the deployment is self-hosted.
docker ps --format "{{.Image}}" | grep budibase
Cloud: check Budibase's status and security communications for your account, and review who held user accounts on your tenant. The advisory says any authenticated user, including free tier accounts, could reach the flaw.
What to do now
- Confirm whether you are on Budibase Cloud or self-hosted.
- If you self-host, keep the platform on 3.30.4 or later as routine hygiene.
- If you are on Cloud, read the vendor's communications for your tenant and ask what, if anything, you need to rotate.
- Rotate credentials that apps built on Budibase hold, such as database passwords and API keys, if the vendor advises it or if you cannot rule out exposure.
- Review app users and remove accounts you do not recognise.
Why it matters
The record lists improper input validation and two code injection classes, CWE-20, CWE-94 and CWE-95. The advisory points to a function that builds a JavaScript function from a view definition and evaluates it directly. Whatever text the user puts in the view map ends up running on the server.
The advisory then explains why that is serious in a shared service. The application pod carries secrets in its environment variables, and the researchers say they confirmed access to the database and the ability to enumerate tenant databases. In multi tenant software, code execution in one shared process can reach the data of many customers at once.
The scope is marked changed in the vector for that reason. A low code platform makes it easy to give many people accounts, so server side evaluation of anything a user typed deserves extra scrutiny.
If you build internal tools on any such platform, keep secrets out of broad process environments where you can, and treat the platform as part of your supply chain.
Why the cloud only detail matters
The advisory is careful to say that self-hosted deployments use native CouchDB views and so do not run the evaluated code path. In the cloud service, a different branch handles the view, and that branch evaluates the user defined function. The exact same product therefore has two risk profiles depending on how it is deployed, and the label self-hosted or cloud decides which applies.
If you are a customer of a hosted low code platform, you depend on the vendor for the code fix and for honest communication about what was reachable. That makes it worth asking some questions of any such vendor, not just this one:
- How are secrets provided to the application processes, and which of them share one environment?
- Is customer data separated by database, by process or only by application logic?
- How quickly do they tell customers when a flaw like this is fixed?
Lessons for teams that build on low code
Internal tools built on these platforms often hold real credentials for databases, payment systems and cloud accounts. Treat them with the same care as production services. Use the narrowest credentials each app needs, rotate them on a schedule, and keep an up to date list of which tools reach which systems, so a platform incident can be scoped quickly.
What a code scan would flag
The advisory shows a pattern that static analysis is good at finding: a function that builds code from a string containing user influenced content, then evaluates it. The record lists the injection classes for that reason. A source code scan can flag evaluation calls on dynamic strings during review, long before a release ships. The demo below shows what that looks like on a sample project.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
I self-host Budibase. Do I need to act on this CVE?
The advisory says self-hosted deployments are not vulnerable. Keep up with updates in general.
Sources
Last reviewed: 19 October 2026.
