GHSA-qw6m-8fw2-2v64

## Summary Budibase's MongoDB query execution endpoint (`POST /api/v2/queries/:queryId`) is vulnerable to NoSQL injection through user-supplied query parameters. The `enrichContext()` function interpolates parameter values into JSON query templates using Handlebars with `noEscaping: true`, then parses the result with `JSON.parse()`. An attacker can inject JSON metacharacters (`"`, `{`, `}`) into parameter values to alter the structure of MongoDB queries, bypassing intended filters to read, modify, or delete arbitrary documents. ## Details The vulnerability exists because input validation and interpolation are misaligned. The `validateQueryInputs()` function blocks Handlebars template syntax (`{{}}`) but does not sanitize JSON structural characters: **packages/server/src/api/controllers/query/index.ts:57-69** ```typescript function validateQueryInputs(parameters: QueryEventParameters) { for (let entry of Object.entries(parameters)) { const [key, value] = entry if (typeof value !== "string") { continue } if (findHBSBlocks(value).length !== 0) { throw new Error( `Parameter '${key}' input contains a handlebars binding - this is not allowed.` ) } } } ``` After validation passes, `enrichContext()` performs raw string interpolation with escaping explicitly disabled: **packages/server/src/sdk/workspace/queries/queries.ts:105-108** ```typescript enrichedQuery[key] = processStringSync(fields[key], parameters, { noEscaping: true, noHelpers: true, escapeNewlines: true, }) ``` The interpolated string is then parsed as JSON at line 122: **packages/server/src/sdk/workspace/queries/queries.ts:122** ```typescript enrichedQuery.json = JSON.parse( enrichedQuery.json || enrichedQuery.customData || enrichedQuery.requestBody ) ``` The parsed object flows directly into MongoDB driver calls with no further sanitization: **packages/server/src/integrations/mongodb.ts:509** ```typescript return await collection.find(json)