Budibase before 3.40.0 contains a NoSQL injection vulnerability in the MongoDB datasource integration where user-supplied parameters are enriched with handlebars using noEscaping: true and parsed without operator filtering. Attackers can inject MongoDB operators through query parameters to bypass per-user access controls, read arbitrary documents, execute JavaScript via $where operators, or modify collections through update and delete operations.
Casky was already ahead
This CVE exploits attack patterns that Casky's 0matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.
Budibase versions before 3.40.0 contain a critical NoSQL injection vulnerability in their MongoDB datasource integration. The vulnerability stems from unsafe parameter enrichment using Handlebars templating with escaping disabled (noEscaping: true), combined with the absence of MongoDB operator filtering. This allows attackers to inject malicious MongoDB operators through query parameters, completely bypassing per-user access controls that should restrict data visibility. Affected organizations using Budibase to manage MongoDB databases face severe risks including unauthorized document retrieval, JavaScript code execution through $where operators, and unauthorized data modification or deletion. Any organization relying on Budibase's access controls for sensitive MongoDB data is at risk until they upgrade to version 3.40.0 or later.
While this CVE lacks direct MITRE ATT&CK technique mapping, Casky's Claude-powered analysis would identify the attack patterns underlying this vulnerability across multiple security skill domains. Practitioners would observe detection opportunities aligned with techniques like T1190 (Exploit Public-Facing Application) for initial injection, T1552 (Unsecured Credentials) for access control bypass, and T1059 (Command and Scripting Interpreter) for the $where JavaScript execution path. Casky's extended reasoning would help security teams recognize the subtle attack flow: parameter injection → template processing without escaping → operator injection → access control circumvention. A practitioner analyzing logs would look for abnormal MongoDB query patterns containing operator syntax ($where, $ne, $regex), requests with special characters in datasource parameters, and queries accessing documents outside the user's designated scope. The platform's mapping of 754 security skills would guide teams toward application-level input validation testing, MongoDB operator whitelisting verification, and secure templating practices to prevent similar injection vectors.
Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →
Casky has 0 skills that investigate the attack patterns behind CVE-2026-73617. Run one and get CVSS-scored findings in 3 minutes.
Run the skill that detects this →© 2026 Casky.AI, Inc. · AI Security Investigation