CVE-2026-19754: Baserow 2.3.3 - SQL injection in formula index() JSONB array extraction
Baserow 2.3.3 contains a SQL injection vulnerability in the index() formula function. A low-privileged authenticated user who can create or modify formula fields can provide an undocumented fourth argument that is treated as a SQL template and interpolated directly into a PostgreSQL expression.
The vulnerable expression is executed when Baserow recalculates formula field values. Because the generated SQL runs through Baserow's database connection, the injected SQL executes with the privileges of the Baserow PostgreSQL role rather than the permissions of the authenticated application user.
This issue affects Baserow: 2.3.3.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue in practice?
A low-privileged authenticated Baserow user can exploit it if they are permitted to create or modify formula fields. No elevated application-level privileges are required beyond that capability.
What triggers execution of the injected SQL?
The SQL is executed when Baserow recalculates the affected formula field's values. The attacker supplies an undocumented fourth argument to the index() formula function, which is treated as a SQL template and interpolated into a PostgreSQL expression.
What database permissions would injected SQL have?
Injected SQL executes using the privileges of the PostgreSQL role used by Baserow's database connection. It does not run with the permissions of the authenticated Baserow user who submitted the formula.
Which version is identified as affected?
The provided information identifies Baserow version 2.3.3 as affected.