CVE-2026-64657: 
JavaScript vulnerability analysis and mitigation

CVE-2026-64657 is a SQL injection vulnerability in Budibase, an open-source low-code platform, affecting the PostgreSQL datasource connector. The flaw exists in packages/server/src/integrations/postgres.ts, where the user-controlled schema configuration field is interpolated directly into a SET search_path SQL statement without escaping embedded double quotes. All Budibase versions prior to 3.39.19 are affected. It was published on August 17, 2026, and carries a CVSS v3.1 base score of 8.4 (High) (GitHub Advisory).

The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). In postgres.ts lines 355–358, each schema name is wrapped in double quotes ("${item.trim()}") without escaping any embedded double-quote characters, then concatenated into a raw SET search_path TO ... statement executed via node-postgres's simple query protocol, which supports multi-statement execution separated by semicolons. An authenticated administrator can set the schema field to a value such as public"; CREATE TABLE pwned AS SELECT usename, passwd FROM pg_shadow; --, causing PostgreSQL to execute both the SET search_path and the injected statement sequentially. The fix (commit 67572a8) introduces a quotePostgresIdentifier utility that doubles embedded double quotes before wrapping, following standard SQL identifier escaping (GitHub Advisory, Fix Commit).

Successful exploitation enables full compromise of the connected PostgreSQL database. An attacker can read sensitive data including pg_shadow password hashes, invoke pg_read_file() to access arbitrary files readable by the PostgreSQL process, and execute arbitrary DDL/DML statements — including creating, modifying, or deleting tables and data. The changed scope (S:C) in the CVSS score reflects that the impact extends beyond the Budibase application itself to the underlying database server and potentially the host filesystem (GitHub Advisory).

Exploitation requires an authenticated administrator account and user interaction (saving or testing a datasource configuration), limiting opportunistic exploitation. No public proof-of-concept exploit code has been observed, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (GitHub Advisory).

1. Gain administrator access: Obtain valid Budibase administrator credentials through phishing, credential stuffing, or insider access.
2. Navigate to datasource configuration: Log into the Budibase admin panel and open or create a PostgreSQL datasource configuration.
3. Inject malicious schema value: Set the schema field to a payload that breaks out of the double-quoted identifier, for example: public"; CREATE TABLE pwned AS SELECT usename, passwd FROM pg_shadow; --
4. Trigger execution: Save the datasource configuration or click "Test connection" to trigger the connectToDB() function, which executes the SET search_path statement.
5. Observe injected SQL execution: The resulting query sent to PostgreSQL becomes SET search_path TO "public"; CREATE TABLE pwned AS SELECT usename, passwd FROM pg_shadow; --, and PostgreSQL executes both statements sequentially via the simple query protocol.
6. Exfiltrate or escalate: Query the newly created table or use further injected SQL to read files via pg_read_file(), extract credentials, or perform additional DDL/DML operations (GitHub Advisory).

• Logs: PostgreSQL server logs showing multi-statement queries originating from the Budibase server connection, particularly SET search_path statements followed by unexpected DDL/DML (e.g., CREATE TABLE, SELECT ... FROM pg_shadow).
• Database: Unexpected tables created in the connected database (e.g., tables named pwned or other anomalous names not part of the application schema); unexpected reads from pg_shadow or system catalog tables.
• Application Logs: Budibase server logs recording datasource save or test events with unusual schema field values containing double quotes or semicolons.
• File System: Evidence of pg_read_file() calls in PostgreSQL logs indicating attempts to read host files accessible to the PostgreSQL process (GitHub Advisory).

Upgrade Budibase to version 3.39.19 or later, which introduces the quotePostgresIdentifier utility that properly escapes embedded double quotes in schema names before constructing the SET search_path statement (Fix Commit). As a short-term workaround prior to patching, restrict administrator access to only trusted users and audit existing PostgreSQL datasource schema configurations for suspicious values containing double quotes or semicolons. Additionally, apply the principle of least privilege to the PostgreSQL database account used by Budibase to limit the impact of any injected SQL (GitHub Advisory).

The vulnerability was reported by security researchers mhr-isham and Mouhebbenelwafi and published by Budibase maintainer mjashanks via GitHub's security advisory process on June 18, 2026. No significant broader media coverage or notable public researcher commentary beyond the official advisory has been identified at this time (GitHub Advisory).