Publish GHSA-726g-59wr-cj4c

Author: advisory-database[bot]

advisories/github-reviewed/2026/03/GHSA-726g-59wr-cj4c/GHSA-726g-59wr-cj4c.json

@@ -0,0 +1,56 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-726g-59wr-cj4c",
+  "modified": "2026-03-09T16:56:26Z",
+  "published": "2026-03-09T16:56:26Z",
+  "aliases": [
+    "CVE-2026-25041"
+  ],
+  "summary": "@budibase/server: Command Injection in PostgreSQL Dump Command",
+  "details": "**Location**: `packages/server/src/integrations/postgres.ts:529-531`  \n\n#### Description\nThe PostgreSQL integration constructs shell commands using user-controlled configuration values (database name, host, password, etc.) without proper sanitization. The password and other connection parameters are directly interpolated into a shell command.\n\n#### Code Reference\n```529:531:packages/server/src/integrations/postgres.ts\n    const dumpCommand = `PGPASSWORD=\"${\n      this.config.password\n    }\" pg_dump --schema-only \"${dumpCommandParts.join(\" \")}\"`\n```\n\n#### Attack Vector\nAn attacker who can control database configuration values (e.g., through compromised credentials or configuration injection) can inject shell commands. For example:\n- Password: `password\"; malicious-command; echo \"`\n- Database name: `db\"; rm -rf /; echo \"`\n\n#### Impact\n- Remote code execution\n- System compromise\n- Data exfiltration\n\n#### Recommendation\n1. Use environment variables for sensitive values instead of command-line arguments\n2. Validate and sanitize all configuration values\n3. Use proper escaping for shell arguments\n4. Consider using a PostgreSQL library's native dump functionality instead of shell commands\n\n#### Example Fix\n```typescript\nimport { execFile } from \"child_process\"\nimport { promisify } from \"util\"\nconst execFileAsync = promisify(execFile)\n\n// Use execFile with proper argument handling\nconst env = {\n  ...process.env,\n  PGPASSWORD: this.config.password\n}\n\nconst args = [\n  \"--schema-only\",\n  \"--host\", this.config.host,\n  \"--port\", this.config.port.toString(),\n  \"--username\", this.config.user,\n  \"--dbname\", this.config.database\n]\n\ntry {\n  const { stdout } = await execFileAsync(\"pg_dump\", args, { env })\n  return stdout\n} catch (error) {\n  // Handle error\n}\n```",
+  "severity": [],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "npm",
+        "name": "@budibase/server"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "3.23.32"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/Budibase/budibase/security/advisories/GHSA-726g-59wr-cj4c"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/Budibase/budibase/commit/9fdbff32fb9e69650ba899a799e13f80d9b09e93"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/Budibase/budibase"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-77"
+    ],
+    "severity": "CRITICAL",
+    "github_reviewed": true,
+    "github_reviewed_at": "2026-03-09T16:56:26Z",
+    "nvd_published_at": null
+  }
+}