{"id":"GHSA-363w-hvwh-w7m6","revision":null,"records":[{"revision":"58bf555bd6104f3d910dbe29caffec9d","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-45719","aliases":[],"title":"Budibase: CouchDB Reduce Injection via Unsanitized Calculation Parameter in V1 Views API","description":"Budibase is an open-source low-code platform. Prior to 3.38.1, the V1 Views API (POST /api/views) accepts a calculation parameter from the request body that is interpolated directly into a CouchDB reduce function definition without validation. Although an internal SCHEMA_MAP object defines the valid calculation types (sum, count, stats), no actual validation is performed against this map before the value is used in string interpolation. A user with Builder permissions can inject arbitrary JavaScript code that will be executed within the CouchDB JavaScript engine when the view is queried. This vulnerability is fixed in 3.38.1.","state":0,"publishedAt":"2026-05-27T17:07:20.961+00:00","modifiedAt":"2026-05-27T18:36:23.178+00:00","affected":[{"ecosystem":"Vendor product","name":"budibase","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Budibase\",\n                    \"product\": \"budibase\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 3.38.1\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","score":6.5,"severity":"MEDIUM"}],"references":["https://github.com/Budibase/budibase/security/advisories/GHSA-363w-hvwh-w7m6","https://github.com/Budibase/budibase/releases/tag/3.38.1"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-45719","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-45719","identifiers":["CVE-2026-45719"]},"retained":false,"historicalAffected":[]},{"revision":"38a24b715da945a59b254a9e98b47576","observedAt":"2026-11-14T00:09:29.223+00:00","statement":{"source":"euvd","id":"EUVD-2026-32599","aliases":["CVE-2026-45719","GHSA-363w-hvwh-w7m6"],"title":"Budibase is an open-source low-code platform. Prior to 3.38.1, the V1 Views API (POST /api/views) accepts a calculation parameter from the request body that is interpolated directly into a CouchDB reduce function definition without validati…","description":"Budibase is an open-source low-code platform. Prior to 3.38.1, the V1 Views API (POST /api/views) accepts a calculation parameter from the request body that is interpolated directly into a CouchDB reduce function definition without validation. Although an internal SCHEMA_MAP object defines the valid calculation types (sum, count, stats), no actual validation is performed against this map before the value is used in string interpolation. A user with Builder permissions can inject arbitrary JavaScript code that will be executed within the CouchDB JavaScript engine when the view is queried. This vulnerability is fixed in 3.38.1.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","score":6.5,"severity":null}],"references":["https://github.com/Budibase/budibase/security/advisories/GHSA-363w-hvwh-w7m6","https://github.com/Budibase/budibase/releases/tag/3.38.1"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-32599","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"May 27, 2026, 5:07:20 PM","dateUpdated":"May 27, 2026, 6:36:23 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-32599","identifiers":["EUVD-2026-32599","CVE-2026-45719","GHSA-363w-hvwh-w7m6"]},"retained":false,"historicalAffected":[]},{"revision":"b310198d74cf40af9340780e279976a5","observedAt":"2026-10-25T12:17:14.897+00:00","statement":{"source":"nvd","id":"CVE-2026-45719","aliases":[],"title":"Budibase is an open-source low-code platform. Prior to 3.38.1, the V1 Views API (POST /api/views) accepts a calculation parameter from the request body that is interpolated directly into a CouchDB reduce function definition without validati…","description":"Budibase is an open-source low-code platform. Prior to 3.38.1, the V1 Views API (POST /api/views) accepts a calculation parameter from the request body that is interpolated directly into a CouchDB reduce function definition without validation. Although an internal SCHEMA_MAP object defines the valid calculation types (sum, count, stats), no actual validation is performed against this map before the value is used in string interpolation. A user with Builder permissions can inject arbitrary JavaScript code that will be executed within the CouchDB JavaScript engine when the view is queried. This vulnerability is fixed in 3.38.1.","state":0,"publishedAt":"2026-05-27T18:16:26.01+00:00","modifiedAt":"2026-06-17T10:52:30.05+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","score":6.5,"severity":"MEDIUM"}],"references":["https://github.com/Budibase/budibase/releases/tag/3.38.1","https://github.com/Budibase/budibase/security/advisories/GHSA-363w-hvwh-w7m6"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-45719","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-94"],"productCriteria":[],"sourceDates":{"published":"2026-05-27T18:16:26.010","lastModified":"2026-06-17T10:52:30.050"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-45719","identifiers":["CVE-2026-45719"]},"retained":false,"historicalAffected":[]},{"revision":"2609ba30a72845549e0ebe5fbd615ac3","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-363w-hvwh-w7m6","aliases":["CVE-2026-45719"],"title":"Budibase: CouchDB Reduce Injection via Unsanitized Calculation Parameter in V1 Views API ","description":"# Security Advisory: CouchDB Reduce Injection via Unsanitized Calculation Parameter in V1 Views API\n\n**Affected Software:** Budibase\n**Affected Component:** `packages/server/src/api/controllers/view/viewBuilder.ts`, `packages/server/src/api/routes/view.ts`\n**CWE:** CWE-94 (Improper Control of Generation of Code)\n**Discovery Date:** 2026-03-24\n\n---\n\n## Summary\n\nThe V1 Views API (`POST /api/views`) accepts a `calculation` parameter from the request body that is interpolated directly into a CouchDB reduce function definition without validation. Although an internal `SCHEMA_MAP` object defines the valid calculation types (`sum`, `count`, `stats`), no actual validation is performed against this map before the value is used in string interpolation.\n\nA user with Builder permissions can inject arbitrary JavaScript code that will be executed within the CouchDB JavaScript engine when the view is queried.\n\n---\n\n## Affected Component\n\n**Route:** `POST /api/views` (V1 legacy views endpoint)\n**File:** `packages/server/src/api/routes/view.ts`, line 45\n\n```js\n.post(\"/api/views\", viewController.v1.save)\n```\n\nNote: This route has no Joi request body validator, unlike the V2 views endpoint which uses `viewValidator()`.\n\n**Vulnerable code:** `packages/server/src/api/controllers/view/viewBuilder.ts`, line 213\n\n```js\nconst reduction = field && calculation ? { reduce: `_${calculation}` } : {}\n\nreturn {\n  meta: { field, tableId, groupBy, filters, schema, calculation, ... },\n  map: `function (doc) { ... }`,\n  ...reduction,    // <-- unvalidated calculation string becomes CouchDB reduce\n}\n```\n\n---\n\n## Vulnerability Detail\n\nThe `viewBuilder` function constructs a CouchDB design document view definition. It correctly sanitizes all inputs that flow into the `map` function string (using `JSON.stringify` for field names and a strict `TOKEN_MAP` allowlist for filter operators).\n\nHowever, the `calculation` parameter follows a different path:\n\n1. User submits `calculation` via `POST /api/views` request body\n2. No Joi validator is present on this V1 route\n3. `viewBuilder` receives `calculation` as a raw string\n4. It is interpolated as: `` reduce: `_${calculation}` ``\n5. This reduce definition is saved to a CouchDB design document\n6. When the view is queried, CouchDB evaluates the reduce value\n\nCouchDB's behavior for reduce functions:\n- Values starting with `_` followed by a known built-in (`_sum`, `_count`, `_stats`) are executed as native reducers\n- Any other value is treated as a **JavaScript function string** and executed in CouchDB's SpiderMonkey JS engine\n\nThe `SCHEMA_MAP` object in the same file defines `sum`, `count`, and `stats` as valid keys, but this map is only used for schema construction — it is never used as an input validator for the `calculation` parameter.\n\n---\n\n## Steps to Reproduce\n\n**Prerequisites:** Authenticated session with Builder role permissions.\n\n**1. Send a crafted view creation request:**\n\n```bash\ncurl -X POST https://<budibase-instance>/api/views \\\n  -H \"Content-Type: application/json\" \\\n  -H \"Cookie: <builder-session-cookie>\" \\\n  -d '{\n    \"name\": \"test_view\",\n    \"tableId\": \"<valid-table-id>\",\n    \"field\": \"amount\",\n    \"calculation\": \"stats\\\"); } function(keys,values,rereduce){ var data = \\\"\\\"; for(var i in this) { data += i + \\\"=\\\" + this[i] + \\\",\\\"; } return data; } //\"\n  }'\n```\n\n**2. Query the created view:**\n\n```bash\ncurl https://<budibase-instance>/api/views/test_view?group=true \\\n  -H \"Cookie: <builder-session-cookie>\"\n```\n\n**3. Expected result:** The injected JavaScript function executes in CouchDB's JS context during reduce evaluation. The function can:\n- Enumerate objects available in the CouchDB sandbox\n- Access document data from the reduce `values` parameter\n- Return arbitrary data in the view response\n\n**Simplified test:** To verify the injection point without complex payloads:\n\n```json\n{\n  \"name\": \"calc_test\",\n  \"tableId\": \"<valid-table-id>\",\n  \"field\": \"amount\",\n  \"calculation\": \"INVALID_NOT_A_BUILTIN\"\n}\n```\n\nThis produces `reduce: \"_INVALID_NOT_A_BUILTIN\"`. CouchDB will reject this as neither a valid built-in nor a valid function, confirming that arbitrary strings reach the reduce evaluator.\n\n---\n\n## Impact\n\n- **Code execution:** Arbitrary JavaScript runs in CouchDB's SpiderMonkey sandbox\n- **Data access:** The reduce function receives all matching document values, allowing data exfiltration across the database\n- **Scope limitation:** CouchDB's JS sandbox prevents filesystem or network access — this is not OS-level RCE\n- **Authentication required:** Attacker must have Builder role, which already grants significant application access\n- **Persistence:** The injected reduce function persists in the design document and executes on every view query\n\n---\n\n## Recommended Fix\n\nAdd an allowlist validation in `viewBuilder` before the reduce interpolation:\n\n```typescript\nconst VALID_CALCULATIONS = [\"sum\", \"count\", \"stats\"];\n\nif (calculation && !VALID_CALCULATIONS.includes(calculation)) {\n  throw new Error(`Invalid calculation type: ${calculation}`);\n}\n\nconst reduction = field && calculation ? { reduce: `_${calculation}` } : {};\n```\n\nAdditionally, add a Joi validator to the V1 views route to match the V2 endpoint:\n\n```typescript\n// In packages/server/src/api/routes/view.ts\n.post(\"/api/views\", v1ViewValidator(), viewController.v1.save)\n```\n\n---\n\n## Additional Context\n\nThe V2 views API (`POST /api/v2/views`) uses `viewValidator()` with Joi schema validation and a separate calculation handling path. This finding is specific to the V1 legacy endpoint which lacks equivalent input validation.\n\nThe `map` function string in the same code is properly protected — all user inputs reaching it are escaped via `JSON.stringify()` or validated against a strict `TOKEN_MAP` allowlist. Only the `reduce` path is affected.","state":0,"publishedAt":"2026-05-18T17:47:58+00:00","modifiedAt":"2026-09-10T03:51:04.3618048+00:00","affected":[{"ecosystem":"npm","name":"@budibase/server","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"3.38.1"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/Budibase/budibase/security/advisories/GHSA-363w-hvwh-w7m6","https://nvd.nist.gov/vuln/detail/CVE-2026-45719","https://github.com/Budibase/budibase","https://github.com/Budibase/budibase/releases/tag/3.38.1"],"sourceUrl":"https://github.com/advisories/GHSA-363w-hvwh-w7m6","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-363w-hvwh-w7m6","identifiers":["GHSA-363w-hvwh-w7m6","CVE-2026-45719"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-15T12:00:55.3946839+00:00","complete":true,"records":1781,"lastAttemptAt":"2026-11-15T12:00:55.3946839+00:00","lastSuccessAt":"2026-11-15T12:00:55.579435+00:00","error":null,"lastVerifiedAt":"2026-11-15T12:00:55.5794357+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-7de4d7559a5263003f03d9f70577ab06f92ba4178309f26fce53e22a4a959294-9f2801eea6d0b63da2583193add6be220e1b53bbbe4ef94b9346425ef1596ca8","complete":true,"records":425788,"lastAttemptAt":"2026-11-15T12:00:54.4294537+00:00","lastSuccessAt":"2026-11-15T12:00:54.4082037+00:00","error":null,"lastVerifiedAt":"2026-11-15T12:00:54.4294537+00:00","snapshotPublishedAt":"2026-11-15T11:26:58+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-850c26e23e9a454eb8654cf34d45fa51","complete":false,"records":13821,"lastAttemptAt":"2026-11-15T12:10:42.9128167+00:00","lastSuccessAt":"2026-11-15T12:10:42.908+00:00","error":"92 identifier lookups failed; latest failures include AccessDenied (HTTP 403). Other identifiers were checked independently.","lastVerifiedAt":"2026-11-15T12:10:42.908+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13568,"expectedIdentifiers":13874,"failedIdentifiers":92},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-15T12:00:55.3946839+00:00","complete":true,"records":1125,"lastAttemptAt":"2026-11-15T12:00:55.3946839+00:00","lastSuccessAt":"2026-11-15T12:00:55.580236+00:00","error":null,"lastVerifiedAt":"2026-11-15T12:00:55.580236+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-d33b5144615b488f88b7a7390696bc39","complete":false,"records":13833,"lastAttemptAt":"2026-11-15T12:01:03.1788889+00:00","lastSuccessAt":"2026-11-15T10:02:36.038+00:00","error":"1 identifier lookups failed; latest failures include HttpError (HTTP 503). Other identifiers were checked independently.","lastVerifiedAt":"2026-11-15T10:02:36.038+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13873,"expectedIdentifiers":13874,"failedIdentifiers":1},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-64eea06dbd27de8464d5dbce1b78cc794cc59e2d901516ae0d3ea76e624cdae0","complete":true,"records":9955,"lastAttemptAt":"2026-11-15T12:00:55.0947737+00:00","lastSuccessAt":"2026-11-14T13:57:23.1208135+00:00","error":null,"lastVerifiedAt":"2026-11-15T12:00:55.0947737+00:00","snapshotPublishedAt":"2026-11-14T13:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-f4424d7d4861b1af1404bd15abcb83f295dcd003412a9340ca99dc8200aa148a","complete":true,"records":2014,"lastAttemptAt":"2026-11-15T12:00:54.588948+00:00","lastSuccessAt":"2026-11-13T19:57:08.2864435+00:00","error":null,"lastVerifiedAt":"2026-11-15T12:00:54.588948+00:00","snapshotPublishedAt":"2026-11-13T19:33:10+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-6086d649bcb454cdf302d7d9275177bda73550e1b6e446b3520e9b6266d3582c","complete":true,"records":3148,"lastAttemptAt":"2026-11-15T12:00:55.3229475+00:00","lastSuccessAt":"2026-11-15T11:05:17.1034234+00:00","error":null,"lastVerifiedAt":"2026-11-15T12:00:55.3229475+00:00","snapshotPublishedAt":"2026-11-15T10:03:04+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-ff18f36f13fcca3a20a3fb9274b59b8872d18869a99071730e1e79b625c8f612","complete":true,"records":232475,"lastAttemptAt":"2026-11-15T12:00:54.6916951+00:00","lastSuccessAt":"2026-11-15T11:05:10.4195883+00:00","error":null,"lastVerifiedAt":"2026-11-15T12:00:54.6916951+00:00","snapshotPublishedAt":"2026-11-15T10:33:06+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}