CVE-2026-64657
Received Received - Intake

PostgreSQL Datasource SQL Injection in Budibase

Publication date: 2026-08-17

Last updated on: 2026-08-17

Assigner: GitHub, Inc.

Description
Budibase is an open-source low-code platform. Prior to 3.39.19, the PostgreSQL datasource connector in packages/server/src/integrations/postgres.ts interpolates the user-controlled schema configuration field into a SET search_path statement without escaping embedded double quotes, allowing an authenticated administrator who saves or tests the datasource to execute arbitrary SQL through the simple query protocol. This issue is fixed in version 3.39.19.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-17
Last Modified
2026-08-17
Generated
2026-08-18
AI Q&A
2026-08-18
EPSS Evaluated
N/A
NVD
CVE-2026-64657
EUVD
EUVD-2026-60379

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
budibase budibase to 3.39.19 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability exists in Budibase, an open-source low-code platform, before version 3.39.19. It involves the PostgreSQL datasource connector improperly handling user-controlled schema input in a SET search_path statement. The connector interpolates this input without escaping double quotes, allowing authenticated administrators to inject arbitrary SQL commands through the simple query protocol.

Detection Guidance

To detect this vulnerability, check if your Budibase instance is running a version prior to 3.39.19. Verify the PostgreSQL datasource connector configuration for improperly escaped schema fields. No specific commands are provided in the context.

Impact Analysis

An authenticated administrator exploiting this flaw could execute arbitrary SQL commands on the database. This may lead to unauthorized data access, modification, or deletion, potentially compromising sensitive information stored in the Budibase instance.

Compliance Impact

This vulnerability could lead to data breaches, violating compliance requirements such as GDPR (data protection) or HIPAA (health information privacy). Unauthorized SQL execution may expose sensitive data, resulting in legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Immediately upgrade Budibase to version 3.39.19 or later to patch the vulnerability. Ensure the PostgreSQL datasource connector properly escapes schema configuration fields to prevent SQL injection.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64657. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart