CVE-2026-82244 - Budibase versions before 3.41.3 contain a remote code execution vulnerability in plugin handling that allows authenticated admin users to execute arbitrary code by uploading a malicious plugin tarball. The server calls eval() on plugin JavaScript files without sandboxing in the main Node.js process, enabling attackers to exfiltrate environment variables and credentials with root privileges in default deployments. - 漏洞详情

漏洞编号：CVE-2026-82244

风险等级：危急

漏洞来源：CVE

CVE 编号：CVE-2026-82244

CNNVD 编号：-

厂商/产品：- / -

影响范围：-

CWE：CWE-94

发布/更新时间：2026-08-28 / 2026-08-28

漏洞描述

Budibase versions before 3.41.3 contain a remote code execution vulnerability in plugin handling that allows authenticated admin users to execute arbitrary code by uploading a malicious plugin tarball. The server calls eval() on plugin JavaScript files without sandboxing in the main Node.js process, enabling attackers to exfiltrate environment variables and credentials with root privileges in default deployments.

漏洞描述

相关链接

相关漏洞