{"data":{"id":"2a71300b-5bcb-4b0c-bc57-d790744f6937","title":"GHSA-rpj4-7x2v-wjrf: Budibase: SSRF in AI Extract File Automation Step via Missing IP Blacklist Validation","summary":"GHSA-rpj4-7x2v-wjrf (CWE-918) affects Budibase. The processUrlFile function in packages/server/src/automations/steps/ai/extract.ts calls fetch(fileUrl) directly, skipping the IP blacklist validation that other automation steps apply through fetchWithBlacklist. An authenticated builder user can therefore make the server request internal addresses such as 169.254.169.254, which may expose cloud metadata credentials and internal services.","solution":"The source text is cut off mid-sentence at \"Replace\" under Proposed Fix and does not state a concrete fix, so: N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-rpj4-7x2v-wjrf","publishedAt":"2026-05-15T17:47:10.000Z","cveId":"CVE-2026-45548","cweIds":null,"cvssScore":null,"cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["@budibase/server@< 3.34.8 (fixed: 3.34.8)"],"affectedPackageNames":["@budibase/server"],"affectedPackageRefs":["npm:@budibase/server"],"affectedVendors":[],"affectedVendorsRaw":["Budibase AI Extract File automation step"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00258,"epssCheckedAt":"2026-11-06T18:11:11.123Z","kevDateAdded":null,"advisoryAliases":["GHSA-rpj4-7x2v-wjrf"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-05-15T17:47:10.000Z","fixReleasedAt":"2026-03-25T09:35:54.511Z","daysToFix":-51,"fixCheckedAt":"2026-10-29T21:35:54.836Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality"],"aiComponentTargeted":"plugin","llmSpecific":false,"classifierConfidence":0.7,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"npm","name":"@budibase/server","fixedVersion":"3.34.8","matchedVersion":"3.34.8","fixReleasedAt":"2026-03-25T09:35:54.511Z","daysToFix":-51,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:35:54.688Z"}]}}