CVE-2026-27702

## Summary A critical unsafe `eval()` vulnerability in Budibase's view filtering implementation allows any authenticated user (including free tier accounts) to execute arbitrary JavaScript code on the server. **This vulnerability ONLY affects Budibase Cloud (SaaS)** - self-hosted deployments use native CouchDB views and are not vulnerable. The vulnerability exists in `packages/server/src/db/inMemoryView.ts` where user-controlled view map functions are directly evaluated without sanitization. The primary impact comes from what lives inside the pod's environment: the `app-service` pod runs with **secrets baked into its environment variables**, including `INTERNAL_API_KEY`, `JWT_SECRET`, CouchDB admin credentials, AWS keys, and more. Using the extracted CouchDB credentials, we verified direct database access, enumerated all tenant databases, and confirmed that user records (email addresses) are readable. ## Details ### Root Cause File: `packages/server/src/db/inMemoryView.ts:28` ```javascript export async function runView( view: DBView, calculation: string, group: boolean, data: Row[] ) { // ... let fn = (doc: Document, emit: any) => emit(doc._id) // BUDI-7060 -> indirect eval call appears to cause issues in cloud eval("fn = " + view?.map?.replace("function (doc)", "function (doc, emit)")) // UNSAFE EVAL // ... } ``` **Why Only Cloud is Vulnerable:** File: `packages/server/src/sdk/workspace/rows/search/internal/internal.ts:194-221` ```typescript if (env.SELF_HOSTED) { // Self-hosted: Uses native CouchDB design documents - NO EVAL response = await db.query(`database/${viewName}`, { include_docs: !calculation, group: !!group, }) } else { // Cloud: Uses in-memory PouchDB with UNSAFE EVAL const tableId = viewInfo.meta!.tableId const data = await fetchRaw(tableId!) response = await inMemoryViews.runView( // <- Calls vulnerable function viewInfo, calculation as string, !!group, data ) } ``` The `view.map`