CVE-2026-19754: Baserow 2.2.0 through 2.3.3 - SQL injection in formula index() JSONB array extraction
Baserow 2.3.3 contains a SQL injection vulnerability in the index() formula function. A low-privileged authenticated user who can create or modify formula fields can provide an undocumented fourth argument that is treated as a SQL template and interpolated directly into a PostgreSQL expression.
The vulnerable expression is executed when Baserow recalculates formula field values. Because the generated SQL runs through Baserow's database connection, the injected SQL executes with the privileges of the Baserow PostgreSQL role rather than the permissions of the authenticated application user.
This issue affects Baserow: 2.3.3.
Other sources
Baserow versions 2.2.0 through 2.3.3 contain an SQL injection vulnerability in the index() formula function. A low-privileged authenticated user who can create or modify Formula fields can provide an undocumented fourth argument that is treated as a SQL template and interpolated directly into a PostgreSQL expression.
The vulnerable expression is executed when Baserow recalculates Formula-field values. Because the generated SQL runs through Baserow's database connection, the injected SQL executes with the privileges of the Baserow PostgreSQL role rather than the permissions of the authenticated application user, allowing data to be read or modified outside the user's workspace permissions.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Baserowto a version that resolves this vulnerability.Fixed in 2.4.0 - Compensating control
Until the upgrade is complete, restrict Formula-field creation and modification to trusted users.
- Operational
Identify Formula definitions containing a fourth index() argument and review database activity for unexpected SQL execution.
Event History
Frequently Asked Questions
Who can exploit this issue in practice?
A low-privileged authenticated Baserow user can exploit it if they are permitted to create or modify formula fields. No elevated application-level privileges are required beyond that capability.
What triggers execution of the injected SQL?
The SQL is executed when Baserow recalculates the affected formula field's values. The attacker supplies an undocumented fourth argument to the index() formula function, which is treated as a SQL template and interpolated into a PostgreSQL expression.
What database permissions would injected SQL have?
Injected SQL executes using the privileges of the PostgreSQL role used by Baserow's database connection. It does not run with the permissions of the authenticated Baserow user who submitted the formula.
Which version is identified as affected?
The provided information identifies Baserow version 2.3.3 as affected.