CVE-2026-73300: Budibase

Critical severity, CVSS 9.6. EPSS: 0.6% chance of exploitation in the next 30 days.

Budibase is an open-source low-code platform. Prior to 3.40.0, the MySQL integration component in Budibase is configured with multipleStatements: true, enabling execution of multiple SQL statements in a single query. Attackers can inject malicious SQL commands through user input fields, leading to complete database compromise. This vulnerability is fixed in 3.40.0.

Affected products

• Budibase Budibase: before 3.40.0 (fixed in 3.40.0)

Published 2026-08-12. Last modified 2026-09-08.