CVE-2026-48149: Budibase: Stored XSS in Text component: BASIC users execute JS in admin session via MarkdownViewer innerHTML + CDN+srcdoc CSP bypass

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-05-27 · updated 2026-06-17
Weakness: CWE-79

Description

Budibase is an open-source low-code platform. Prior to 3.39.0, the Budibase Text component renders markdown by assigning marked.parse(markdown) straight to innerHTML with no sanitizer (packages/bbui/src/Markdown/MarkdownViewer.svelte:22). Any column a builder binds to a Text component in Markdown mode is a stored-XSS sink writable by every BASIC app user with WRITE on the underlying table. This vulnerability is fixed in 3.39.0.

Affected products

budibase: before 3.39.0

References

https://github.com/Budibase/budibase/security/advisories/GHSA-57p7-9h9w-xqpw
https://github.com/Budibase/budibase/security/advisories/GHSA-57p7-9h9w-xqpw

Get alerted when CVE-2026-48149 or the next vulnerability affects your stack