{"action":"Upgrade @budibase/server to 3.41.3 or later.","affected":[{"fixed":"3.41.3","introduced":"0"}],"component":"@budibase/server","cve_ids":["CVE-2026-35219"],"ecosystem":"npm","epss":0.00465,"exploited":false,"fixed_versions":["3.41.3"],"ghsa_id":"GHSA-5fpj-28rv-84r7","id":"tcs_01M5KF3JSRKST39G3ED81RB19J","modified_at":"2026-08-14T19:41:00.947989Z","published_at":"2026-08-14T19:18:47Z","references":["https://osv.dev/vulnerability/GHSA-5fpj-28rv-84r7","https://github.com/Budibase/budibase/security/advisories/GHSA-5fpj-28rv-84r7","https://github.com/Budibase/budibase","https://github.com/Budibase/budibase/releases/tag/3.41.3"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-5fpj-28rv-84r7","url":"https://osv.dev/vulnerability/GHSA-5fpj-28rv-84r7"}],"summary":"Budibase: SSRF in Automation Steps - Webhook, Zapier, N8N, Slack, Discord Bypass IP Blacklist"}