CVE-2026-48149 Overview
CVE-2026-48149 is a stored cross-site scripting (XSS) vulnerability in Budibase, an open-source low-code application platform. The flaw exists in the MarkdownViewer.svelte component, which passes marked.parse(markdown) output directly to innerHTML without sanitization. Any column bound to a Text component in Markdown mode becomes a stored-XSS sink. Authenticated BASIC app users with WRITE permission on the underlying table can inject persistent malicious scripts. The vulnerability is fixed in Budibase 3.39.0.
Critical Impact
Authenticated low-privilege users can inject persistent JavaScript that executes in the browser of any user viewing the affected Budibase application, enabling session theft and account takeover.
Affected Products
- Budibase versions prior to 3.39.0
- packages/bbui/src/Markdown/MarkdownViewer.svelte component
- Budibase Text components configured in Markdown mode
Discovery Timeline
- 2026-05-27 - CVE-2026-48149 published to NVD
- 2026-05-27 - Last updated in NVD database
Technical Details for CVE-2026-48149
Vulnerability Analysis
The vulnerability is a stored cross-site scripting flaw classified as [CWE-79]. Budibase's MarkdownViewer.svelte component at line 22 renders markdown by directly assigning the output of marked.parse(markdown) to the DOM innerHTML property. The marked library produces HTML output but does not sanitize embedded HTML or JavaScript by default. Any markdown content reaching this rendering path can include raw <script> tags, event handler attributes, or javascript: URIs that execute in the victim's browser session.
Because the rendered content originates from database columns bound to Text components, the payload persists across sessions and executes for every subsequent viewer of the application. The attack surface includes any table column a builder has bound to a Text component in Markdown mode.
Root Cause
The root cause is missing output sanitization between the markdown parser and the DOM sink. The marked library converts markdown syntax to HTML but preserves inline HTML by design. Without an intermediate sanitizer such as DOMPurify, raw HTML and script content survive the parsing step. Direct assignment to innerHTML then evaluates that content in the application origin.
Attack Vector
Exploitation requires an authenticated Budibase user holding the BASIC role with WRITE permission on a table whose column feeds a markdown-mode Text component. The attacker inserts a malicious payload into that column through normal data entry workflows. When any other user, including administrators, loads the screen containing the Text component, the injected script executes in their browser context. The script can exfiltrate session cookies, perform authenticated API requests, or pivot to higher-privileged actions inside the Budibase application.
The vulnerability mechanism is described in the GitHub Security Advisory GHSA-57p7-9h9w-xqpw.
Detection Methods for CVE-2026-48149
Indicators of Compromise
- Database rows in Budibase-backed tables containing <script>, onerror=, onload=, or javascript: substrings in columns bound to markdown Text components.
- Unexpected outbound browser requests from authenticated Budibase sessions to attacker-controlled domains.
- Anomalous session token usage from IP addresses inconsistent with the legitimate user.
Detection Strategies
- Query Budibase application tables for HTML or script syntax in text columns, focusing on those bound to Text components in Markdown mode.
- Inspect browser security logs and Content Security Policy (CSP) violation reports for inline script execution attempts on Budibase application origins.
- Audit application binding configurations to enumerate all columns currently rendered as markdown.
Monitoring Recommendations
- Enable web application firewall (WAF) logging on Budibase API endpoints that write to tables, and alert on payloads containing script tags or event handler attributes.
- Monitor Budibase audit logs for WRITE operations performed by BASIC users on tables feeding markdown views.
- Forward Budibase server and proxy logs into a centralized analytics platform for retrospective hunting of injected payloads.
How to Mitigate CVE-2026-48149
Immediate Actions Required
- Upgrade Budibase to version 3.39.0 or later, which sanitizes markdown output before assignment to innerHTML.
- Inventory all tables and columns bound to Text components configured in Markdown mode and review their current contents for injected HTML.
- Restrict WRITE permissions on tables feeding markdown views to trusted roles until the upgrade is applied.
Patch Information
The vulnerability is fixed in Budibase 3.39.0. The fix sanitizes parser output before it reaches the DOM. Refer to the Budibase GitHub Security Advisory for the official remediation notice and release details.
Workarounds
- Switch Text components from Markdown mode to plain text rendering until the upgrade is deployed.
- Remove or revoke BASIC role WRITE access on tables whose columns drive markdown-rendered Text components.
- Deploy a strict Content Security Policy that disallows inline scripts on the Budibase application origin to limit payload execution.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
