Summary A low-privileged application end-user (role `BASIC` - not a builder or admin, and on a public data-collection form, an unauthenticated visitor) can store an HTML/JavaScript payload in ordinary row data. When a builder or admin later opens that table in the Budibase Builder and evaluates any Handlebars binding whose Preview surfaces the value (the Data-section Formula column editor, or any binding drawer), the stored value is rendered as raw HTML and the attacker's JavaScript executes in the Builder's origin. The Builder SPA is served by nginx with no Content-Security-Policy (the CSP middleware only decorates the server-rendered published-app document, not `/builder/`). The injected script therefore runs unrestricted in the highest-trust surface of the product - the admin/builder session that can create datasources, run server-side JavaScript via automations, read and modify every table, and manage users. This is a cross-privilege stored XSS (app end-user → builder/admin), i.e. full workspace takeover, not self-XSS.