Baserow versions 2.2.0 through 2.3.3 contain an SQL injection vulnerability in the index() formula function. A low-privileged authenticated user who can create or modify Formula fields can provide an undocumented fourth argument that is treated as a SQL template and interpolated directly into a PostgreSQL expression. The generated SQL executes through Baserow's database connection with the Baserow PostgreSQL role permissions, allowing data outside the user's workspace permissions to be read or modified.

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation poc

Automatable no

Technical Impact total

Affected Vendors & Products

Vendors Products
Baserow
  • Baserow

No data.

No data.

References
Link Providers
https://fluidattacks.com/es/advisories/superestrella cve-icon cve-icon cve-icon
https://github.com/baserow/baserow cve-icon cve-icon
https://github.com/baserow/baserow/commit/e7abc14975124dfe4558ff47fb8b9a25c47d9fcc cve-icon cve-icon
https://github.com/baserow/baserow/releases/tag/2.3.4 cve-icon cve-icon
History

Fri, 23 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
References

Fri, 23 Oct 2026 18:45:00 +0000

Type Values Removed Values Added
References

Fri, 23 Oct 2026 18:30:00 +0000

Type Values Removed Values Added
References

Fri, 23 Oct 2026 17:45:00 +0000

Type Values Removed Values Added
Description Baserow versions 2.2.0 through 2.3.3 contain an SQL injection vulnerability in the index() formula function. A low-privileged authenticated user who can create or modify Formula fields can provide an undocumented fourth argument that is treated as a SQL template and interpolated directly into a PostgreSQL expression. The vulnerable expression is executed when Baserow recalculates Formula-field values. Because the generated SQL runs through Baserow's database connection, the injected SQL executes with the privileges of the Baserow PostgreSQL role rather than the permissions of the authenticated application user, allowing data to be read or modified outside the user's workspace permissions. Baserow versions 2.2.0 through 2.3.3 contain an SQL injection vulnerability in the index() formula function. A low-privileged authenticated user who can create or modify Formula fields can provide an undocumented fourth argument that is treated as a SQL template and interpolated directly into a PostgreSQL expression. The generated SQL executes through Baserow's database connection with the Baserow PostgreSQL role permissions, allowing data outside the user's workspace permissions to be read or modified.
References

Tue, 20 Oct 2026 23:45:00 +0000

Type Values Removed Values Added
Description Baserow versions 2.2.0 through 2.3.3 contain an SQL injection vulnerability in the index() formula function. A low-privileged authenticated user who can create or modify Formula fields can provide an undocumented fourth argument that is treated as a SQL template and interpolated directly into a PostgreSQL expression. The vulnerable expression is executed when Baserow recalculates Formula-field values. Because the generated SQL runs through Baserow's database connection, the injected SQL executes with the privileges of the Baserow PostgreSQL role rather than the permissions of the authenticated application user, allowing data to be read or modified outside the user's workspace permissions. Baserow versions 2.2.0 through 2.3.3 contain an SQL injection vulnerability in the index() formula function. A low-privileged authenticated user who can create or modify Formula fields can provide an undocumented fourth argument that is treated as a SQL template and interpolated directly into a PostgreSQL expression. The vulnerable expression is executed when Baserow recalculates Formula-field values. Because the generated SQL runs through Baserow's database connection, the injected SQL executes with the privileges of the Baserow PostgreSQL role rather than the permissions of the authenticated application user, allowing data to be read or modified outside the user's workspace permissions.

Tue, 20 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
References

Tue, 20 Oct 2026 00:00:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:baserow:baserow:*:*:*:*:*:*:*:* cpe:2.3:a:baserow:baserow:*:*:linux:*:*:*:*:*
cpe:2.3:a:baserow:baserow:*:*:macos:*:*:*:*:*
cpe:2.3:a:baserow:baserow:*:*:windows:*:*:*:*:*

Mon, 19 Oct 2026 23:45:00 +0000

Type Values Removed Values Added
Description Baserow versions 2.2.0 through 2.3.3 contain an SQL injection vulnerability in the index() formula function. A low-privileged authenticated user who can create or modify Formula fields can provide an undocumented fourth argument that is treated as a SQL template and interpolated directly into a PostgreSQL expression. The vulnerable expression is executed when Baserow recalculates Formula-field values. Because the generated SQL runs through Baserow's database connection, the injected SQL executes with the privileges of the Baserow PostgreSQL role rather than the permissions of the authenticated application user, allowing data to be read or modified outside the user's workspace permissions. Baserow versions 2.2.0 through 2.3.3 contain an SQL injection vulnerability in the index() formula function. A low-privileged authenticated user who can create or modify Formula fields can provide an undocumented fourth argument that is treated as a SQL template and interpolated directly into a PostgreSQL expression. The vulnerable expression is executed when Baserow recalculates Formula-field values. Because the generated SQL runs through Baserow's database connection, the injected SQL executes with the privileges of the Baserow PostgreSQL role rather than the permissions of the authenticated application user, allowing data to be read or modified outside the user's workspace permissions.

Mon, 19 Oct 2026 23:30:00 +0000

Type Values Removed Values Added
Description Baserow versions 2.2.0 through 2.3.3 contain an SQL injection vulnerability in the index() formula function. An authenticated user who can create or edit Formula fields can pass an undocumented fourth argument. Baserow inserts this argument into a PostgreSQL expression. The injected SQL runs with the Baserow database role permissions and can read or modify database data outside the user's workspace permissions. Baserow versions 2.2.0 through 2.3.3 contain an SQL injection vulnerability in the index() formula function. A low-privileged authenticated user who can create or modify Formula fields can provide an undocumented fourth argument that is treated as a SQL template and interpolated directly into a PostgreSQL expression. The vulnerable expression is executed when Baserow recalculates Formula-field values. Because the generated SQL runs through Baserow's database connection, the injected SQL executes with the privileges of the Baserow PostgreSQL role rather than the permissions of the authenticated application user, allowing data to be read or modified outside the user's workspace permissions.

Mon, 19 Oct 2026 22:45:00 +0000

Type Values Removed Values Added
Description Baserow 2.3.3 contains a SQL injection vulnerability in the index() formula function. A low-privileged authenticated user who can create or modify formula fields can provide an undocumented fourth argument that is treated as a SQL template and interpolated directly into a PostgreSQL expression. The vulnerable expression is executed when Baserow recalculates formula field values. Because the generated SQL runs through Baserow's database connection, the injected SQL executes with the privileges of the Baserow PostgreSQL role rather than the permissions of the authenticated application user. This issue affects Baserow: 2.3.3. Baserow versions 2.2.0 through 2.3.3 contain an SQL injection vulnerability in the index() formula function. An authenticated user who can create or edit Formula fields can pass an undocumented fourth argument. Baserow inserts this argument into a PostgreSQL expression. The injected SQL runs with the Baserow database role permissions and can read or modify database data outside the user's workspace permissions.
Title Baserow 2.3.3 - SQL injection in formula index() JSONB array extraction Baserow 2.2.0 through 2.3.3 - SQL injection in formula index() JSONB array extraction
CPEs cpe:2.3:a:baserow:baserow:2.3.3:*:linux:*:*:*:*:*
cpe:2.3:a:baserow:baserow:2.3.3:*:macos:*:*:*:*:*
cpe:2.3:a:baserow:baserow:2.3.3:*:windows:*:*:*:*:*		 cpe:2.3:a:baserow:baserow:*:*:*:*:*:*:*:*
References

Wed, 02 Sep 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 02 Sep 2026 04:00:00 +0000

Type Values Removed Values Added
Description Baserow 2.3.3 contains a SQL injection vulnerability in the index() formula function. A low-privileged authenticated user who can create or modify formula fields can provide an undocumented fourth argument that is treated as a SQL template and interpolated directly into a PostgreSQL expression. The vulnerable expression is executed when Baserow recalculates formula field values. Because the generated SQL runs through Baserow's database connection, the injected SQL executes with the privileges of the Baserow PostgreSQL role rather than the permissions of the authenticated application user. This issue affects Baserow: 2.3.3. Baserow 2.3.3 contains a SQL injection vulnerability in the index() formula function. A low-privileged authenticated user who can create or modify formula fields can provide an undocumented fourth argument that is treated as a SQL template and interpolated directly into a PostgreSQL expression. The vulnerable expression is executed when Baserow recalculates formula field values. Because the generated SQL runs through Baserow's database connection, the injected SQL executes with the privileges of the Baserow PostgreSQL role rather than the permissions of the authenticated application user. This issue affects Baserow: 2.3.3.

Wed, 02 Sep 2026 03:45:00 +0000

Type Values Removed Values Added
Description Baserow 2.3.3 contains a SQL injection vulnerability in the index() formula function. A low-privileged authenticated user who can create or modify formula fields can provide an undocumented fourth argument that is treated as a SQL template and interpolated directly into a PostgreSQL expression. The vulnerable expression is executed when Baserow recalculates formula field values. Because the generated SQL runs through Baserow's database connection, the injected SQL executes with the privileges of the Baserow PostgreSQL role rather than the permissions of the authenticated application user. This issue affects Baserow: 2.3.3.
Title Baserow 2.3.3 - SQL injection in formula index() JSONB array extraction
First Time appeared Baserow
Baserow baserow
Weaknesses CWE-89
CPEs cpe:2.3:a:baserow:baserow:2.3.3:*:linux:*:*:*:*:*
cpe:2.3:a:baserow:baserow:2.3.3:*:macos:*:*:*:*:*
cpe:2.3:a:baserow:baserow:2.3.3:*:windows:*:*:*:*:*
Vendors & Products Baserow
Baserow baserow
References
Metrics cvssV4_0

{'score': 8.6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N'}
cve-icon MITRE

Status: PUBLISHED

Assigner: Fluid Attacks

Published: 2026-09-02T03:29:38.759Z

Updated: 2026-10-23T18:30:35.412Z

Reserved: 2026-08-13T15:37:56.088Z

Link: CVE-2026-19754

cve-icon Vulnrichment

Updated: 2026-09-02T12:58:21.412Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-02T04:17:51.537

Modified: 2026-10-23T19:17:44.790

Link: CVE-2026-19754

cve-icon Redhat

No data.