CVE-2026-73408

Name of the Vulnerable Software and Affected Versions Budibase versions prior to 3.39.18

Description In the packages/server/src/integrations/mysql.ts file, the application enables multipleStatements and inserts an unescaped tableName into a DESCRIBE statement. This allows an attacker who can create a MySQL table containing a backtick and a stacked statement in its name to execute arbitrary commands when a Budibase administrator performs schema discovery. The issue is resolved by applying the quoteMySqlIdentifier() function before constructing the query.

Recommendations Update to version 3.39.18.