SCA: security update for budibase (GHSA-xh5j-727m-w6gg)

high Tenable Cloud Security Plugin ID 478597

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- Budibase is an open-source low-code platform. Prior to 3.35.10, the Plugin URL upload endpoint (POST
/api/plugin) validates the submitted URL with a single substring check: url.includes(".tar.gz"). Any URL
containing .tar.gz anywhere in the string — in the path, query string, or fragment — passes this check.
The URL then proceeds directly to fetchWithBlacklist() with no further validation of host, scheme, or
path. Standalone, this vulnerability is blocked by Budibase's default SSRF blacklist, which covers private
IP ranges. But the URL validation layer itself is broken regardless, and it directly enables SSRF in two
realistic situations: (1) when chained with the BLACKLIST_IPS bypass ([001]), where the blacklist is
empty; and (2) when the plugin server follows HTTP redirects from an external URL to an internal target
(the default node-fetch behavior with redirect: 'follow'). This vulnerability is fixed in 3.35.10.
(CVE-2026-45061)

Solution

Update the budibase library and its related packages to version 3.35.10 or later.

Plugin Details

Severity: High

ID: 478597

Version: Revision 1.1

Type: Local

Family: SCA Checks

Published: 11/6/2026

Updated: 11/6/2026

Risk Information

VPR

Risk Factor: Low

Score: 3.3

Percentile: 51.26

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:N/A:N

CVSS Score Source: CVE-2026-45061

CVSS v3

Risk Factor: High

Base Score: 7.7

Temporal Score: 6.7

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 5/11/2026

Vulnerability Publication Date: 5/11/2026

Reference Information

CVE: CVE-2026-45061

cwe: CWE-918

Detections

Analytics