Budibase, an open-source low-code platform, contains a stored cross-site scripting (XSS) vulnerability in versions prior to 3.39.0. The vulnerability exists in the Text component's markdown rendering functionality, where marked.parse(markdown) is assigned directly to innerHTML without sanitization. Any user with BASIC access and WRITE permissions on the underlying table can exploit this vulnerability through markdown mode text components. The issue affects the MarkdownViewer.svelte component and has been fixed in version 3.39.0.