CVE-2026-45719

🗓️ 27 May 2026 17:07:20Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 14 Views🌐 WEB

Budibase V1 Views API allows reduce injection with Builder permissions, enabling code execution.

Reporter	Title	Published	Views	Family All 13
ATTACKERKB	CVE-2026-45719	27 May 202617:07	–	attackerkb
Circl	CVE-2026-45719	27 May 202619:08	–	circl
CNNVD	Budibase 安全漏洞	27 May 202600:00	–	cnnvd
Cvelist	CVE-2026-45719 Budibase: CouchDB Reduce Injection via Unsanitized Calculation Parameter in V1 Views API	27 May 202617:07	–	cvelist
EUVD	EUVD-2026-32599	27 May 202617:07	–	euvd
Github Security Blog	Budibase: CouchDB Reduce Injection via Unsanitized Calculation Parameter in V1 Views API	18 May 202617:47	–	github
NVD	CVE-2026-45719	27 May 202618:16	–	nvd
OSV	GHSA-363W-HVWH-W7M6 Budibase: CouchDB Reduce Injection via Unsanitized Calculation Parameter in V1 Views API	18 May 202617:47	–	osv
Positive Technologies	PT-2026-41797	18 May 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-45719	5 Jun 202619:32	–	redhatcve

Vulners

Node

budibase budibaseRange<3.38.1

[
  {
    "vendor": "Budibase",
    "product": "budibase",
    "versions": [
      {
        "version": "< 3.38.1",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/Budibase/budibase/security/advisories/GHSA-363w-hvwh-w7m6
github	www.github.com/Budibase/budibase/releases/tag/3.38.1

Parameter	Position	Path	Description	CWE
calculation	request body	/api/views	V1 Views API (POST /api/views) accepts a calculation parameter interpolated into CouchDB reduce function without validation, enabling arbitrary JS execution via the CouchDB JavaScript engine when a view is queried.	CWE-94

17 Jun 2026 10:52Current

6Medium risk

Vulners AI Score6

CVSS 3.16.5

EPSS0.00263

SSVC

CWE-94