Description
Previously, budibase used a library called vm2 for code execution inside the Budibase builder and apps, such as the UI below for configuring bindings in the design section.
Recommendation
Update the @budibase/server package to the latest compatible version. Followings are version details:
- Affected version(s): < 2.20.0
- Patched version(s): 2.20.0
References
Related Issues
- devalue affected by CPU and memory amplification from sparse arrays - Vulnerability
- @budibase/server: Command Injection in PostgreSQL Dump Command - CVE-2026-25041
- Budibase: Path traversal in plugin file upload enables arbitrary directory deletion and file write - CVE-2026-35214
- Budibase: Unauthenticated Remote Code Execution via Webhook Trigger and Bash Automation Step - CVE-2026-35216
You might also like:
- Tags:
- npm
- @budibase/server
Anything's wrong? Let us know Last updated on March 18, 2026