Back exploit-intel.com

CVE-2026-82244: Budibase before 3.41.3 Remote Code Execution via Plugin eval() [CRITICAL] CVSS 9.4 Exploit Intelligence - Recent CVEs / 1d Budibase versions before 3.41.3 contain a remote code execution vulnerability in plugin handling that allows authenticated admin users to execute arbitrary code by uploading a malicious plugin tarball. The server calls eval() on plugin JavaScript files without sandboxing in the main Node.js process, enabling attackers to exfiltrate environment variables and c

exploit-intel.com • August 29, 2026

Budibase versions before 3.41.3 contain a remote code execution vulnerability in plugin handling that allows authenticated admin users to execute arbitrary code by uploading a malicious plugin tarball. The server calls eval() on plugin JavaScript files without sandboxing in the main Node.js process, enabling attackers to exfiltrate environment variables and credentials with root privileges in default deployments.

CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 28, 2026 · Source: CVE List

Default status: unaffected

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical RCE Vulnerability in Budibase Affects Versions Before 3.41.3 Budibase versions prior to 3.41.3 have a critical remote code execution vulnerability (CVE-2026-82244) affecting plugin handling. This flaw allows authenticated admin users to upload malicious plugin tarballs, executing arbitrary code due to the server's use of eval() on un-sandboxed JavaScript files. Attackers can potentially exfiltrate sensitive environment variables and credentials with root privileges. Currently, there is no evidence of exploitation in the wild or public proof-of-concept exploits. A patch is available, and users are urged to upgrade to version 3.41.3 or later. Security measures should include restricting admin access and monitoring for suspicious uploads. The CVSS score for this vulnerability is 9.4, indicating a critical severity level. The vulnerability was published on August 28, 2026. 2 sources 71

Extracted Entities

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)

Platforms (1)