Budibase: Command Injection in Bash Automation Step

Budibase is an open-source low-code platform. Prior to version 3.33.4, the bash automation step executes user-provided commands using execSync without proper sanitization or validation. User input is processed through processStringSync which allows template interpolation, potentially allowing arbitrary command execution. This issue has been patched in version 3.33.4.

N/A

OS命令中使用的特殊元素转义处理不恰当(OS命令注入)

Budibase 操作系统命令注入漏洞

Budibase是英国Budibase开源的一个用于在几分钟内创建内部应用程序、工作流和管理面板的低代码平台。 Budibase 3.33.4之前版本存在操作系统命令注入漏洞，该漏洞源于bash自动化步骤未对用户输入进行清理和验证，可能导致任意命令执行。

N/A

N/A