Baserow 2.3.3 contains a SQL injection vulnerability in the index() formula function. A low-privileged authenticated user who can create or modify formula fields can provide an undocumented fourth argument that is treated as a SQL template and interpolated directly into a PostgreSQL expression.
The vulnerable expression is executed when Baserow recalculates formula field values. Because the generated SQL runs through Baserow's database connection, the injected SQL executes with the privileges of the Baserow PostgreSQL role rather than the permissions of the authenticated application user.
This issue affects Baserow: 2.3.3.
The vulnerable expression is executed when Baserow recalculates formula field values. Because the generated SQL runs through Baserow's database connection, the injected SQL executes with the privileges of the Baserow PostgreSQL role rather than the permissions of the authenticated application user.
This issue affects Baserow: 2.3.3.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Baserow | Baserow | unaffected |
|
No data.
No data.
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Wed, 02 Sep 2026 03:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Baserow 2.3.3 contains a SQL injection vulnerability in the index() formula function. A low-privileged authenticated user who can create or modify formula fields can provide an undocumented fourth argument that is treated as a SQL template and interpolated directly into a PostgreSQL expression. The vulnerable expression is executed when Baserow recalculates formula field values. Because the generated SQL runs through Baserow's database connection, the injected SQL executes with the privileges of the Baserow PostgreSQL role rather than the permissions of the authenticated application user. This issue affects Baserow: 2.3.3. | |
| Title | Baserow 2.3.3 - SQL injection in formula index() JSONB array extraction | |
| First Time appeared |
Baserow
Baserow baserow |
|
| Weaknesses | CWE-89 | |
| CPEs | cpe:2.3:a:baserow:baserow:2.3.3:*:linux:*:*:*:*:* cpe:2.3:a:baserow:baserow:2.3.3:*:macos:*:*:*:*:* cpe:2.3:a:baserow:baserow:2.3.3:*:windows:*:*:*:*:* |
|
| Vendors & Products |
Baserow
Baserow baserow |
|
| References |
| |
| Metrics |
cvssV4_0
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: Fluid Attacks
Published:
Updated: 2026-09-02T03:49:40.755Z
Reserved: 2026-08-13T15:37:56.088Z
Link: CVE-2026-19754
Vulnrichment
No data.
NVD
No data.
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses