GHSA-q6x4-v3qx-85qw: Budibase: SQL Injection via `multipleStatements: true`

July 24, 2026

A critical SQL injection vulnerability was discovered in Budibase’s MySQL integration that allows remote attackers to execute arbitrary SQL commands.

References

github.com/Budibase/budibase/releases/tag/3.40.0
github.com/Budibase/budibase/security/advisories/GHSA-q6x4-v3qx-85qw
github.com/advisories/GHSA-q6x4-v3qx-85qw

Code Behaviors & Features

Detect and mitigate GHSA-q6x4-v3qx-85qw with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →