CVE-2026-73617

Budibase before 3.40.0 has a NoSQL injection in the MongoDB datasource integration. User-supplied parameters are enriched with handlebars using noEscaping: true and parsed without operator filtering, allowing injection of MongoDB operators through query parameters. Impact described includes bypas...