CVE-2026-73300
Received Received - Intake

MySQL Integration SQL Injection in Budibase

Publication date: 2026-08-12

Last updated on: 2026-08-12

Assigner: GitHub, Inc.

Description
Budibase is an open-source low-code platform. Prior to 3.40.0, the MySQL integration component in Budibase is configured with multipleStatements: true, enabling execution of multiple SQL statements in a single query. Attackers can inject malicious SQL commands through user input fields, leading to complete database compromise. This vulnerability is fixed in 3.40.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-12
Last Modified
2026-08-12
Generated
2026-08-13
AI Q&A
2026-08-12
EPSS Evaluated
N/A
NVD
CVE-2026-73300
EUVD
EUVD-2026-57394

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
budibase budibase to 3.40.0 (exc)
budibase budibase 3.40.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a critical SQL injection vulnerability in Budibase's MySQL integration. The issue occurs because the MySQL integration is configured with multipleStatements: true, allowing attackers to execute multiple SQL statements in a single query. This enables malicious SQL command injection through user input fields, potentially leading to severe database compromise.

Detection Guidance

Check Budibase version with npm list -g budibase or docker inspect <container> | grep Budibase. If version is below 3.40.0, the system is vulnerable. Inspect MySQL integration config file packages/server/src/integrations/mysql.ts for multipleStatements: true setting.

Impact Analysis

Attackers could exploit this to destroy data, steal sensitive information, escalate privileges, disrupt services via denial of service, or gain complete control over the database. The vulnerability requires user interaction and has a high impact on confidentiality, integrity, and availability.

Compliance Impact

This vulnerability could lead to unauthorized data access or destruction, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Non-compliance risks include legal penalties, fines, and reputational damage due to compromised sensitive data.

Mitigation Strategies

Upgrade Budibase to version 3.40.0 or later immediately. Update the MySQL integration configuration to set multipleStatements: false in mysql.ts. Review and sanitize all user input fields to prevent SQL injection.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73300. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart