Description
Previously, budibase used a library called vm2 for code execution inside the Budibase builder and apps, such as the UI below for configuring bindings in the design section.
Recommendation
Update the @budibase/server package to the latest compatible version. Followings are version details:
- Affected version(s): < 2.20.0
- Patched version(s): 2.20.0
References
Related Issues
- @budibase/server: Command Injection in PostgreSQL Dump Command - CVE-2026-25041
- Budibase Improper Control of Dynamically-Managed Code Resources vulnerability - CVE-2022-3225
- Budibase: SSRF in AI Extract File Automation Step via Missing IP Blacklist Validation - CVE-2026-45548
- Budibase: SSRF Bypass via HTTP Redirect in REST Datasource Integration - CVE-2026-45715
You might also like:
- Tags:
- npm
- @budibase/server
Anything's wrong? Let us know Last updated on March 18, 2026