AUGUST 4, 2026
Live Feed
Back to database
Case File

CVE-2026-35218

HIGH · CVSS 8.7 EPSS 0.33% Public Exploit

Source: NVD + CISA KEV + EPSS (historical backfill) · Published 2026-04-03 · Last synced 2026-08-04

CyberRota Analysis

This is a high severity vulnerability with a CVSS score of 8.7. Public exploit code or proof-of-concept references have been detected in its references. Exploitation may require the attacker to be authenticated.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-35218
Severity
HIGH
CVSS
8.7
EPSS
0.33%

Original NVD Description

Budibase is an open-source low-code platform. Prior to version 3.32.5, Budibase's Builder Command Palette renders entity names (tables, views, queries, automations) using Svelte's {@html} directive without any sanitization. An authenticated user with Builder access can create a table, automation, view, or query whose name contains an HTML payload (e.g. <img src=x onerror=alert(document.domain)>). When any Builder-role user in the same workspace opens the Command Palette (Ctrl+K), the payload executes in their browser, stealing their session cookie and enabling full account takeover. This issue has been patched in version 3.32.5.

Related CVEs

Other vulnerabilities affecting the same vendor(s)