CVE-2026-72853

EUVD-2026-58503
Budibase before 3.40.0 contains a SQL injection vulnerability in the Oracle datasource connector's post-write row lookup that fails to escape table names in identifiers. Attackers with write permission on a table with a double-quote in its name can inject SQL that executes as the datasource's database user to read or modify arbitrary data.
SQL Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
7.6 HIGH
NETWORK
HIGH
HIGH
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 25.2%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
budibasebudibase
𝑥
< 3.40.0
CNA
Common Weakness Enumeration
References
https://github.com/Budibase/budibase/security/advisories/GHSA-xj29-x47g-9w2c
https://www.vulncheck.com/advisories/budibase-before-sql-injection-via-oracle-connector
https://github.com/Budibase/budibase/security/advisories/GHSA-xj29-x47g-9w2c