What is CVE-2026-64657?

CVE-2026-64657 is a high-severity vulnerability in Budibase, classified under SQL Injection. CVSS score: 8.4/10. Published 2026-08-17.

How severe is CVE-2026-64657?

High severity. CVSS v3 base score is 8.4 out of 10.

SQL Injection in Budibase

CVE-2026-64657

Budibase is an open-source low-code platform. Prior to 3.39.19, the PostgreSQL datasource connector in packages/server/src/integrations/postgres.ts interpolates the user-controlled schema configuration field into a SET search_path statement without escaping embedded double quotes, allowing an authenticated administrator who saves or tests the datasource to execute arbitrary SQL through the simple query protocol. This issue is fixed in version 3.39.19.

Vulnerability class: SQL Injection

CVSS v3 metric

CVSS v3 base score 8.4 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H.

Affected products

Budibase — versions < 3.39.19

Weakness classification (CWE)

CWE-89 — SQL Injection

References

security-advisories@github.com (x_refsource_CONFIRM)
security-advisories@github.com (x_refsource_MISC)

Frequently asked questions

What is CVE-2026-64657?: CVE-2026-64657 is a high-severity vulnerability in Budibase, classified under SQL Injection. CVSS score: 8.4/10. Published 2026-08-17.
How severe is CVE-2026-64657?: High severity. CVSS v3 base score is 8.4 out of 10.