NoSQL Injection Vulnerability in Budibase MongoDB Integration

Budibase versions prior to 3.40.0 contain a critical NoSQL injection vulnerability within the MongoDB datasource integration. The vulnerability stems from the application's processing of user-supplied parameters using Handlebars with the 'noEscaping: true' setting enabled, combined with a lack of robust operator filtering.

This flaw allows an attacker to inject MongoDB-specific operators directly into query parameters. Because the input is not sanitized or restricted, an attacker can manipulate database queries to bypass existing row-level or per-user access controls. The impact is severe, enabling unauthorized read access to arbitrary documents, potential modification or deletion of collection data, and the execution of server-side JavaScript through operators such as '$where'. This vulnerability is particularly dangerous in environments where the Budibase backend connects to MongoDB databases containing sensitive business logic or user data.

Impact

Successful exploitation allows attackers to bypass application-level access controls, leading to unauthorized data exfiltration or modification. In instances where the MongoDB instance allows the '$where' operator, attackers could escalate the impact to arbitrary code execution on the database server. This impacts all organizations using Budibase 3.39.x and earlier versions that integrate with MongoDB.

Recommendation

• Upgrade Budibase instances to version 3.40.0 or later immediately to patch CVE-2026-73617.
• Audit logs for suspicious MongoDB queries involving unconventional operators (e.g., $where, $gt, $ne, $regex) originating from the Budibase application server.
• Implement strict input validation and query parameterization for any user-facing inputs bound to MongoDB datasource queries.
• Apply the principle of least privilege to the service account credentials used by Budibase to connect to MongoDB, restricting permissions to only those necessary for required operations.