CVE-2026-64657: 
JavaScript vulnerability analysis and mitigation

CVE-2026-64657 is a SQL injection vulnerability in Budibase's PostgreSQL datasource connector that allows an authenticated administrator to execute arbitrary SQL commands. The flaw exists in packages/server/src/integrations/postgres.ts, where the user-controlled schema configuration field is interpolated directly into a SET search_path SQL statement without escaping embedded double quotes. All Budibase versions prior to 3.39.19 are affected. It was published on August 17, 2026, and carries a CVSS v3.1 base score of 8.4 (High) (GitHub Advisory).

The root cause is CWE-89 (SQL Injection): the vulnerable code in postgres.ts (lines 355–358) splits the schema configuration field by commas, wraps each item in double quotes, and passes the result directly to this.client.query() via the simple query protocol — without escaping embedded double-quote characters. Because node-postgres's simple query protocol supports multi-statement execution separated by semicolons, an attacker-controlled schema value containing an embedded " can terminate the identifier early and append arbitrary SQL statements. Exploitation requires the attacker to have administrator-level access to the Budibase instance and to save or test a PostgreSQL datasource configuration (GitHub Advisory, Fix Commit).

Successful exploitation results in full database compromise, including the ability to read sensitive data such as pg_shadow password hashes, invoke pg_read_file() to access arbitrary files readable by the PostgreSQL process, and execute arbitrary DDL/DML statements against the connected database. The scope change in the CVSS score reflects that the impact extends beyond the Budibase application itself to the underlying PostgreSQL database and potentially the host filesystem. Confidentiality, integrity, and availability are all rated High (GitHub Advisory).

According to NVD SSVC data, a proof-of-concept exists for this vulnerability, though there is no current evidence of active in-the-wild exploitation (Feedly). The EPSS score is approximately 0.0024 (0.24%), indicating a low but non-zero probability of exploitation in the near term. Exploitation is not automatable as it requires an authenticated administrator to interact with the datasource configuration UI. No threat actor attribution or CISA KEV catalog listing has been identified for this CVE.

1. Gain Administrator Access: Obtain valid administrator credentials for a Budibase instance running a version prior to 3.39.19, either through credential theft, phishing, or reuse of compromised credentials.
2. Navigate to PostgreSQL Datasource Configuration: Log in to the Budibase admin panel and open or create a PostgreSQL datasource connector.
3. Craft Malicious Schema Value: In the schema configuration field, enter a payload that breaks out of the double-quoted identifier and appends arbitrary SQL, for example: public"; CREATE TABLE pwned AS SELECT usename, passwd FROM pg_shadow; --
4. Trigger Execution: Save the datasource configuration or click the connection test button. This causes the server to execute the following query via the simple query protocol: SET search_path TO "public"; CREATE TABLE pwned AS SELECT usename, passwd FROM pg_shadow; --
5. Achieve Objective: PostgreSQL executes both statements sequentially. The attacker can now read password hashes, exfiltrate data, create/drop tables, or invoke server-side functions such as pg_read_file() to access host filesystem files (GitHub Advisory).

• Logs: PostgreSQL server logs showing multi-statement queries originating from the Budibase application user, particularly SET search_path statements followed by DDL/DML commands (e.g., CREATE TABLE, SELECT ... FROM pg_shadow).
• Database: Unexpected tables created in the connected PostgreSQL database (e.g., tables named pwned or other anomalous names not part of the application schema); unexpected reads from pg_shadow or other system catalogs.
• Network: Unusual outbound connections from the PostgreSQL server process to external hosts, which may indicate data exfiltration following exploitation.
• Application: Budibase audit logs showing administrator-level datasource save or test actions with anomalous schema field values containing double-quote characters or semicolons (GitHub Advisory).

Budibase has released version 3.39.19, which fixes this vulnerability by replacing the unsafe string interpolation with a quotePostgresIdentifier() utility function that properly escapes embedded double quotes (doubling them per PostgreSQL identifier quoting rules) before constructing the SET search_path statement. Administrators should upgrade to version 3.39.19 or later immediately. As a temporary workaround prior to patching, restrict administrator access to the Budibase instance and avoid configuring PostgreSQL datasources with untrusted schema values (GitHub Advisory, Fix Commit).