Budibase affected by VM2 Constructor Escape Vulnerability

Description

Previously, budibase used a library called vm2 for code execution inside the Budibase builder and apps, such as the UI below for configuring bindings in the design section.

Recommendation

Update the @budibase/server package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.20.0
• Patched version(s): 2.20.0

References

• GHSA-4g2x-vq5p-5vj6
• CWE-94
• OWASP 2021-A3

Related Issues

• Budibase Improper Access Control vulnerability - CVE-2022-3225
• Redwood is vulnerable to account takeover via dbAuth "forgot-password - Vulnerability
• Saltcorn's Reflected XSS and Command Injection vulnerabilities can be chained for 1-click-RCE - Vulnerability
• Incorrect default cookie name and recommendation - Vulnerability

Tags:

npm

@budibase/server