GHSA-pmpg-2mxq-6xwr: Budibase: NoSQL injection in MongoDB integration: collection dump, $where JS exec, cross-collection pivot, arbitrary update/delete

Summary An end-user injection in Budibase's MongoDB datasource lets any BASIC app user bypass the builder's query-level access controls. Builders scope MongoDB reads per-user with bindings like {"email": "{{ currentUser.email }}"} so each app user only sees their own rows. Because the binding is handlebars-enriched into the query JSON with noEscaping: true and then JSON.parsed, Bob (a BASIC user) overrides the builder's filter with a MongoDB operator and reads every document the connection can touch. SQL datasources are parameterized through interpolateSQL(); the MongoDB path has no equivalent, so the scoping pattern Budibase's own docs show is unsafe. Details Enrichment packages/server/src/sdk/workspace/queries/queries.ts:105-125 enriches every string field of the query with handlebars, then parses the enriched json field: enrichedQuery[key] = processStringSync(fields[key], parameters, { noEscaping: true, noHelpers: true, escapeNewlines: true, }) // ... enrichedQuery.json = JSON.parse( enrichedQuery.json || enrichedQuery.customData || enrichedQuery.requestBody ) noEscaping: true turns {{name}} into {{{name}}}, which Handlebars renders without HTML-escaping. Any " or } the attacker supplies lands verbatim in the enriched string. JSON.parse then produces a structured object whose top-level keys and operators came from the parameter value. Execution packages/server/src/integrations/mongodb.ts:499-512: async read(query: MongoDBQuery) { try { await this.connect() const db = this.client.db(this.config.db) const collection = db.collection(query.extra.collection) let json = this.createObjectIds(query.json) switch (query.extra.actionType) { case "find": { if (json) { return await collection.find(json).toArray() } createObjectIds walks the object and rewrites strings that look like ObjectId(...). It does not strip $-prefixed keys and does not reject operator-shaped values. The injected filter reaches collection.find unchanged. For comparison, SQL datasources go th