Budibase: Remote Code Execution via Unsafe eval() in View Filter Map Function (Budibase Cloud)
Date: 2026-02
Affected: npm/budibase
Attack vector: xss
Category: vulnerability-disclosure
Severity: Critical
CVE: CVE-2026-27702
CWE: CWE-20
CWE-94
CWE-95
CVSS: 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L)

## Summary A critical unsafe `eval()` vulnerability in Budibase's view filtering implementation allows any authenticated user (including free tier accounts) to execute arbitrary JavaScript code on the server. **This vulnerability ONLY affects Budibase Cloud (SaaS)** - self-hosted deployments use native CouchDB views and are not vulnerable. The vulnerability exists in `packages/server/src/db/inMemoryView.ts` where user-controlled view map functions are directly evaluated without sanitization. The primary impact comes from what lives inside the pod's environment: the `app-service` pod runs with **secrets baked into its environment variables**, including `INTERNAL_API_KEY`, `JWT_SECRET`, CouchDB admin credentials, AWS keys, and more. Using the extracted CouchDB credentials, we verified direct database access, enumerated all tenant databases, and confirmed that user records (email addresses) are readable. ## Details ### Root Cause File: `packages/server/src/db/inMemoryView.ts:28` ```javascript export async function runView( view: DBView, calculation: string, group: boolean, data: Row[] ) { // ... let fn = (doc: Document, emit: any) => emit(doc._id) // BUDI-7060 -> indirect eval call appears to cause issues in cloud eval("fn = " + view?.map?.replace("function (doc)", "function (doc, emit)")) // UNSAFE EVAL // ... } ``` **Why Only Cloud is Vulnerable:** File: `packages/server/src/sdk/workspace/rows/search/internal/internal.ts:194-221` ```typescript if (e


Mitigations:

Architectural layers (MAESTRO):