GHSA-pmpg-2mxq-6xwr

## Summary An end-user injection in Budibase's MongoDB datasource lets any BASIC app user bypass the builder's query-level access controls. Builders scope MongoDB reads per-user with bindings like `{"email": "{{ currentUser.email }}"}` so each app user only sees their own rows. Because the binding is handlebars-enriched into the query JSON with `noEscaping: true` and then `JSON.parse`d, Bob (a BASIC user) overrides the builder's filter with a MongoDB operator and reads every document the connection can touch. SQL datasources are parameterized through `interpolateSQL()`; the MongoDB path has no equivalent, so the scoping pattern Budibase's own docs show is unsafe. ## Details ### Enrichment `packages/server/src/sdk/workspace/queries/queries.ts:105-125` enriches every string field of the query with handlebars, then parses the enriched `json` field: ```typescript enrichedQuery[key] = processStringSync(fields[key], parameters, { noEscaping: true, noHelpers: true, escapeNewlines: true, }) // ... enrichedQuery.json = JSON.parse( enrichedQuery.json || enrichedQuery.customData || enrichedQuery.requestBody ) ``` `noEscaping: true` turns `{{name}}` into `{{{name}}}`, which Handlebars renders without HTML-escaping. Any `"` or `}` the attacker supplies lands verbatim in the enriched string. `JSON.parse` then produces a structured object whose top-level keys and operators came from the parameter value. ### Execution `packages/server/src/integrations/mongodb.ts:499-512`: ```typescript async read(query: MongoDBQuery) { try { await this.connect() const db = this.client.db(this.config.db) const collection = db.collection(query.extra.collection) let json = this.createObjectIds(query.json) switch (query.extra.actionType) { case "find": { if (json) { return await collection.find(json).toArray() } ``` `createObjectIds` walks the object and rewrites strings that look like `ObjectId(...)`. It does not strip `$`-prefixe