Unauthenticated NoSQL operator injection in Budibase published-app query templates

CVE-2026-54350 affects Budibase prior to version 3.39.12. The flaw is in how published-app query templates process user-supplied parameters for JSON-based backend queries. In enrichContext at packages/server/src/sdk/workspace/queries/queries.ts:121-138, Budibase substitutes parameter values directly into a raw JSON query body and then parses the resulting string with JSON.parse(). Input validation in validateQueryInputs at packages/server/src/api/controllers/query/index.ts:61-71 blocks only Handlebars markers such as {{ and }}, but does not escape JSON metacharacters including quotes, backslashes, or closing braces. As a result, an attacker can inject crafted parameter values that break out of the intended JSON value and introduce attacker-controlled fields or operators into the parsed query object. For MongoDB find operations, the attacker-influenced filter is passed directly to collection.find() at packages/server/src/integrations/mongodb.ts:506-510, enabling filter manipulation such as replacing a builder-defined predicate with one that matches the full collection. The same primitive can be used against updateMany at mongodb.ts:577-585 to broaden the update scope to all documents while preserving the builder-defined update body. The issue is reachable without authentication because the authorized middleware at packages/server/src/middleware/authorized.ts:141-148 short-circuits for queries marked PUBLIC, and POST /api/v2/queries/:queryId accepts requests without a session when supplied with the publicly obtainable x-budibase-app-id header. Affected backends include MongoDB, CouchDB, Elasticsearch, DynamoDB-PartiQL, and REST-with-JSON-body collections.