{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"3.38.1"}],"component":"@budibase/server","cve_ids":["CVE-2026-73617"],"ecosystem":"npm","epss":0.00343,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-pmpg-2mxq-6xwr","id":"tcs_01M5KG40S72YNS0V2VBDMQAMVW","modified_at":"2026-08-14T04:12:08.148547696Z","published_at":"2026-07-24T21:43:34Z","references":["https://osv.dev/vulnerability/GHSA-pmpg-2mxq-6xwr","https://github.com/Budibase/budibase/security/advisories/GHSA-pmpg-2mxq-6xwr","https://github.com/Budibase/budibase/pull/18907","https://github.com/Budibase/budibase/commit/dd8c0654b35cd89ce3645f2355f4bf2ff9a5dd80","https://github.com/Budibase/budibase","https://github.com/Budibase/budibase/releases/tag/3.39.9"],"severity":{"label":"high","score":7.1},"sources":[{"source":"osv","source_id":"GHSA-pmpg-2mxq-6xwr","url":"https://osv.dev/vulnerability/GHSA-pmpg-2mxq-6xwr"}],"summary":"Budibase: NoSQL injection in MongoDB integration: collection dump, $where JS exec, cross-collection pivot, arbitrary update/delete"}