CVE-2026-42239

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

Budibase is an open-source low-code platform. Prior to version 3.35.10, the budibase:auth cookie containing the JWT session token is set with httpOnly: false at packages/backend-core/src/utils/utils.ts:218. JavaScript can read this cookie via document.cookie. This means every XSS becomes a full account takeover — the attacker steals the JWT and has persistent access to the victim's account. The cookie also lacks secure: true (sent over plaintext HTTP) and sameSite attribute. This issue has been patched in version 3.35.10.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N

Weakness enumeration

CWE-1004

Affected software

Vendor	Product	Versions
Budibase	budibase	< 3.35.10

References

https://github.com/Budibase/budibase/releases/tag/3.35.10Patch, Release Notes
https://github.com/Budibase/budibase/security/advisories/GHSA-4f9j-vr4p-642rExploit, Mitigation, Vendor Advisory
https://github.com/Budibase/budibase/security/advisories/GHSA-4f9j-vr4p-642rExploit, Mitigation, Vendor Advisory

Timeline

Published: May 7, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-42247.5When an Expat parser with a registered ElementDeclHandler parses an inline document type definition containing a deeply nested content model CVE-2026-422415.3ParquetSharp is a .NET library for reading and writing Apache Parquet files. From version 18.1.0 to before version 23.0.0.1, DecimalConverte CVE-2026-422457.5Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, Net:CVE-2026-422467.4Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.3.10, 0.4.24, 0.5.14, and 0.6 CVE-2026-422489.8Ollama for Windows does not perform integrity or authenticity verification of downloaded update executables. Unlike other platforms, the Win CVE-2026-422499.8Ollama for Windows contains a Remote Code Execution vulnerability in its update mechanism due to improper handling of attacker‑controlled HT CVE-2026-42252.4A security flaw has been discovered in CMS Made Simple up to 2.2.21. Impacted is an unknown function of the file admin/listusers.php of the CVE-2026-422504.8bzip2 contains an off‑by‑one error in the bzip2recover utility. When processing a specially crafted file, the application performs an out‑of CVE-2026-422518.7Use of hard-coded credentials in KS-SOMED allowed an unauthorized attacker access to FTP server that hosted the application's update package CVE-2026-422529.1Apache Airflow's official documentation at `core-concepts/dag-run.html` ("Passing Parameters when triggering Dags") showed a verbatim `BashO CVE-2026-422536.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache ActiveMQ, Apache ActiveMQ Web. CVE-2026-422544.0Hickory DNS hickory-recursor 0.1 through 0.25.2 allows cross-zone poisoning because cached data is not directly associated with a query that