Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
Budibase/budibase
master @ 2060f62
256
Fixes
25
CVEs
CRITICAL
Peak severity
41.2%
Coverage
Highlights
Auth Bypass: 139 prior fixes. Scrutinize any change in this area.
packages/worker/src/api/controllers/global/users.ts: most-fixed (13 issues). Treat as high-risk during review.
173 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Frequent regex matching and session validation flaws in the authentication middleware historically allowed unauthenticated users to access privileged routes or bypass session expiration controls. Ensure proper anchorage of URL matches and rigid check sequences.
SSRF: Budibase provides outbound REST connectors and webhooks that are vulnerable to DNS rebinding and redirect-loop SSRF bypasses of the internal IP blacklist. Outbound requests must rely on pinned IPs via a custom HTTP agent.
Command Injection: Dangerous execution patterns utilizing unparameterized shell commands allowed attackers with automation execution privileges to compromise the host container via command injection.