Summary
Budibase: MySQL DESCRIBE Backtick Injection via multipleStatements in Database Connector
This is a related but independently fixable vulnerability to GHSA-qqf5-x7mj-v43p
(PostgreSQL SQL injection), reported in the same original disclosure and
split per GitHub CNA guidance (rule 4.2.11) since it affects a separate
integration, has a distinct attack precondition, and requires a separate
patch.
The MySQL integration enables multipleStatements: true on the connection,
permitting semicolon-separated multi-statement execution. During table
introspection, table names retrieved from INFORMATION_SCHEMA.TABLES are
interpolated into a DESCRIBE query wrapped in backticks, but embedded
backticks in the table name are never escaped, allowing a malicious table
name to break out and inject a second, attacker-controlled statement.
Details
Vulnerable Code:
File: packages/server/src/integrations/mysql.ts, lines 172, 305
this.config = { ...config, multipleStatements: true, ... } // line 172
...
{ sql: `DESCRIBE \`${tableName}\`;` } // line 305, backtick NOT escaped
Because multipleStatements is enabled, any statement appended after the
backtick break-out executes as a second query in the same round trip.
Step-by-Step Reproduction
- An attacker with the ability to create tables in the target MySQL
database (e.g. a lower-privileged database user, or a malicious actor in
a multi-tenant database) creates a table named:foo`; DROP TABLE users; -- - In Budibase, an administrator triggers schema introspection for that
database (e.g. opening the datasource or refreshing its table list). - Budibase reads the malicious table name from
INFORMATION_SCHEMA.TABLES
and interpolates it into theDESCRIBEquery. - The unescaped backtick terminates the identifier early, and the
semicolon-separated payload (enabled bymultipleStatements: true)
executes as a second statement.
Impact
Arbitrary SQL execution triggered during routine schema discovery. Unlike
the PostgreSQL and MS SQL Server findings, this does not require the
attacker to control the Budibase datasource configuration directly, only
the ability to create a maliciously named table in the underlying database
beforehand, with an administrator's normal use of the introspection feature
serving as the trigger.
Untrusted input alters a database query, allowing the attacker to read or modify data the query was not intended to access. Typical impact: data disclosure or modification.
GHSA-2XGG-R2WC-C5R2 has a CVSS score of 7.6 (High). The vector is network-reachable, high privileges required, and user interaction required. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. No fixed version is listed yet, so configuration controls and monitoring matter more in the interim.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
In the interim: Use parameterized queries or prepared statements so user input is always treated as data, never as SQL syntax.
Kodem Kai can prioritize this vulnerability in your dependency tree and generate a fix recommendation.
Frequently Asked Questions
- What is GHSA-2XGG-R2WC-C5R2? GHSA-2XGG-R2WC-C5R2 is a high-severity SQL injection vulnerability in @budibase/server (npm), affecting versions <= 3.38.1. No fixed version is listed yet. Untrusted input alters a database query, allowing the attacker to read or modify data the query was not intended to access.
- How severe is GHSA-2XGG-R2WC-C5R2? GHSA-2XGG-R2WC-C5R2 has a CVSS score of 7.6 (High). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
- Which versions of @budibase/server are affected by GHSA-2XGG-R2WC-C5R2? @budibase/server (npm) versions <= 3.38.1 is affected.
- Is there a fix for GHSA-2XGG-R2WC-C5R2? No fixed version is listed for GHSA-2XGG-R2WC-C5R2 yet. Monitor the advisory for updates and apply mitigations in the interim.
- Is GHSA-2XGG-R2WC-C5R2 exploitable, and should I be worried? Whether GHSA-2XGG-R2WC-C5R2 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether GHSA-2XGG-R2WC-C5R2 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix GHSA-2XGG-R2WC-C5R2? No fixed version is listed yet. In the interim: Use parameterized queries or prepared statements so user input is always treated as data, never as SQL syntax.