Budibase: Command Injection in Bash Automation Step
Date: 2026-04
Affected: npm/@budibase/server
Attack vector: command-injection
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2026-25044
CWE: CWE-78
CVSS: 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

**Location**: `packages/server/src/automations/steps/bash.ts` #### Description The bash automation step executes user-provided commands using `execSync` without proper sanitization or validation. User input is processed through `processStringSync` which allows template interpolation, potentially allowing arbitrary command execution. #### Code Reference ```21:28:packages/server/src/automations/steps/bash.ts const command = processStringSync(inputs.code, context) let stdout, success = true try { stdout = execSync(command, { timeout: environment.QUERY_THREAD_TIMEOUT, }).toString() ``` #### Attack Vector An attacker with access to create or modify automations can inject malicious shell commands by including template syntax that evaluates to command injection payloads (e.g., `$(rm -rf /)`, `; malicious-command`, `| malicious-command`). #### Impact - Remote code execution (RCE) - Complete system compromise - Data exfiltration - Lateral movement within the infrastructure #### Recommendation 1. **Immediate**: Disable bash automation step in production until fixed 2. Implement a whitelist of allowed commands 3. Use parameterized command execution with proper escaping 4. Implement command argument validation 5. Consider using a restricted shell or command sandboxing 6. Add rate limiting and monitoring for command execution #### Example Fix ```typescript import { spawn } from "child_process" // Validate against whitelist const ALLOWED_COMM


Mitigations:

Architectural layers (MAESTRO):