Json-Injection

Budibase Unauthenticated NoSQL Operator Injection (CVE-2026-54350)

Budibase queries interpolate user-supplied parameters directly into a query's raw JSON body via Handlebars, then JSON.parse the result. The only input filter blocks Handlebars markers ({{/}}) but does not block ", \, } or $ — so a parameter value containing a…