The noEscaping: true flag on this handlebars enrichment path is the analytically significant detail. That flag doesn't get set during normal development — it gets set when a developer decides strict output encoding interferes with legitimate use cases, then accepts the residual risk. The critical question is whether that risk decision was ever revisited as the application grew beyond its original scope, or whether it calcified into technical debt that subsequent developers built around rather than through.
This NoSQL injection is severe because MongoDB's $where operator allows JavaScript execution server-side — not theoretical lateral movement, but a direct path from a web request parameter to arbitrary code. Combined with the access control bypass, an attacker doesn't need an existing account foothold; they can inject operators that the application's own query layer would have prevented. The MongoDB datasource integration became a privilege escalation mechanism for unauthenticated actors.
The filtering gap — operator filtering was never implemented despite the handlebars enrichment being flagged as unsafe — reveals either a threat model that didn't anticipate NoSQL operator injection, or one that decided filtering was too complex for the integration's scope. Either answer exposes a failure in how datasource integrations are security-assessed.
Worse, the blast radius extends beyond one database. In Budibase's architecture, datasources aren't isolated endpoints — they're platform-level components that multiple applications build on top of. Compromising this connector potentially exposes every application, every user, and every piece of data that touched that datasource. The impact represents a scope modification beyond what CVSS 7.1 captures.
The pattern is not new. CVE-2019-10758 (lodash prototype pollution), CVE-2019-20149 (MongoDB Express unauthenticated RCE), and numerous template-injection-turned-RCE cases follow the same genealogical arc: template rendering gains database access, escaping gets disabled to fix legitimate operator usage, the unsafe configuration becomes load-bearing infrastructure, and eventually someone publicly weaponizes the chain. The institutional failure isn't unique to Budibase — it's the predictable outcome of how security-critical flags get adopted without genealogical review. Organizations hit by this pattern once tend to get hit again through different attack surfaces because the underlying failure is in how risk decisions get recorded and propagated, not in specific code.
Check your codebase for the combination of template rendering + database queries + noEscaping — particularly in datasource connectors (PostgreSQL, Redis, REST) that may share this architectural pressure. Operator whitelisting is the documented compensating control, but the harder fix is institutional: mechanisms that force revisitation of noEscaping flags when datasources connect to new application layers.