{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@budibase/server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "3.38.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-89"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-24T21:26:19Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\n**This is a related but independently fixable vulnerability to GHSA-qqf5-x7mj-v43p\n(PostgreSQL SQL injection), reported in the same original disclosure and\nsplit per GitHub CNA guidance (rule 4.2.11) since it affects a separate\nintegration, has a distinct attack precondition, and requires a separate\npatch.**\n\nThe MySQL integration enables `multipleStatements: true` on the connection,\npermitting semicolon-separated multi-statement execution. During table\nintrospection, table names retrieved from `INFORMATION_SCHEMA.TABLES` are\ninterpolated into a `DESCRIBE` query wrapped in backticks, but embedded\nbackticks in the table name are never escaped \u2014 allowing a malicious table\nname to break out and inject a second, attacker-controlled statement.\n\n### Details\n\n**Vulnerable Code:**\nFile: `packages/server/src/integrations/mysql.ts`, lines 172, 305\n\n```typescript\nthis.config = { ...config, multipleStatements: true, ... }  // line 172\n...\n{ sql: `DESCRIBE \\`${tableName}\\`;` }  // line 305 \u2014 backtick NOT escaped\n```\n\nBecause `multipleStatements` is enabled, any statement appended after the\nbacktick break-out executes as a second query in the same round trip.\n\n### Step-by-Step Reproduction\n1. An attacker with the ability to create tables in the target MySQL\n   database (e.g. a lower-privileged database user, or a malicious actor in\n   a multi-tenant database) creates a table named:\n   ``foo`; DROP TABLE users; --``\n2. In Budibase, an administrator triggers schema introspection for that\n   database (e.g. opening the datasource or refreshing its table list).\n3. Budibase reads the malicious table name from `INFORMATION_SCHEMA.TABLES`\n   and interpolates it into the `DESCRIBE` query.\n4. The unescaped backtick terminates the identifier early, and the\n   semicolon-separated payload (enabled by `multipleStatements: true`)\n   executes as a second statement.\n\n### Impact\nArbitrary SQL execution triggered during routine schema discovery. Unlike\nthe PostgreSQL and MS SQL Server findings, this does not require the\nattacker to control the Budibase datasource configuration directly \u2014 only\nthe ability to create a maliciously named table in the underlying database\nbeforehand, with an administrator\u0027s normal use of the introspection feature\nserving as the trigger.",
  "id": "GHSA-2xgg-r2wc-c5r2",
  "modified": "2026-07-24T21:26:19Z",
  "published": "2026-07-24T21:26:19Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Budibase/budibase/security/advisories/GHSA-2xgg-r2wc-c5r2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Budibase/budibase/pull/18989"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Budibase/budibase/commit/2c61f389c9986c91ddd8ae161c2b5e8ec21c60ac"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Budibase/budibase"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Budibase/budibase/releases/tag/3.39.18"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Budibase: MySQL DESCRIBE Backtick Injection via multipleStatements in Database Connector"
}