GHSA-hfhx-w8p8-4hc7: Budibase: SSRF via bare fetch() in uploadUrl during AI table generation
mediumvulnerabilityLLM-Specific
security
Source: GitHub Advisory DatabaseJuly 24, 2026
Summary
Budibase's `uploadUrl()` function uses a bare `fetch()` call without protection against SSRF (server-side request forgery, where a server is tricked into fetching URLs it shouldn't access). When the AI table generation feature processes attachment column values that are URLs, a builder-level user can craft prompts to make the LLM generate internal IP addresses or cloud metadata endpoints, which are then fetched server-side without validation, potentially exposing internal services and cloud metadata APIs.
Classification
Attack Type
RAG Poisoning
Attack SophisticationModerate
Impact (CIA+S)
confidentialityintegrity
Affected Vendors
Affected Packages
@budibase/server@<= 3.38.1
Related Issues
Monthly digest — independent AI security research
Original source: https://github.com/advisories/GHSA-hfhx-w8p8-4hc7
First tracked: July 24, 2026 at 08:00 PM
Classified by LLM (prompt v3) · confidence: 92%