Budibase versions before 3.41.3 contain a remote code execution vulnerability in plugin handling that allows authenticated admin users to execute arbitrary code by uploading a malicious plugin tarball. The server calls eval() on plugin JavaScript files without sandboxing in the main Node.js process, enabling attackers to exfiltrate environment variables and credentials with root privileges in default deployments.

Budibase versions prior to 3.41.3 contain a critical remote code execution vulnerability in the plugin handling mechanism. Authenticated admin users can exploit this flaw by uploading a malicious plugin tarball to the server. The root cause is the use of eval() on plugin JavaScript files without any sandboxing, executed directly in the main Node.js process. This allows attackers to run arbitrary code with root privileges in default deployments. Sensitive data such as environment variables and credentials can be exfiltrated as a result. The vulnerability requires admin-level authentication, limiting the attack surface but not eliminating the risk in multi-tenant or compromised credential scenarios. A patch is available in Budibase version 3.41.3 and later. Advisories have been published on GitHub Security Advisories and VulnCheck.