What is GHSA-mv4c-5rgh-72q9?

GHSA-mv4c-5rgh-72q9 is a security advisory published by GitHub Security Advisories with High severity. Budibase before 3.40.0 contains a SQL injection vulnerability in the Oracle datasource connector...

Which CVE IDs does GHSA-mv4c-5rgh-72q9 cover?

GHSA-mv4c-5rgh-72q9 covers the following CVE IDs: CVE-2026-72853. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-mv4c-5rgh-72q9?

GHSA-mv4c-5rgh-72q9 has a CVSS v3 base score of 7.6, published by GitHub Security Advisories.

GHSA-mv4c-5rgh-72q9HighCVSS 7.6

Budibase before 3.40.0 contains a SQL injection vulnerability in the Oracle datasource connector...

Vendor

GitHub Security Advisories

Published

August 14, 2026

Last Modified

August 14, 2026

🔗 CVE IDs covered (1)

CVE-2026-72853 →

📋 Description

Budibase before 3.40.0 contains a SQL injection vulnerability in the Oracle datasource connector's post-write row lookup that fails to escape table names in identifiers. Attackers with write permission on a table with a double-quote in its name can inject SQL that executes as the datasource's database user to read or modify arbitrary data.

🔗 References (4)

https://github.com/Budibase/budibase/security/advisories/GHSA-xj29-x47g-9w2c
https://nvd.nist.gov/vuln/detail/CVE-2026-72853
https://www.vulncheck.com/advisories/budibase-before-sql-injection-via-oracle-connector
https://github.com/advisories/GHSA-mv4c-5rgh-72q9