CVE-2026-19754

Baserow 2.2.0 through 2.3.3 - SQL injection in formula index() JSONB array extraction

State: Published
Severity: 8.6 High
Published: Sep 2, 2026
Updated: Oct 23, 2026
Reserved: Aug 13, 2026

Description

Baserow versions 2.2.0 through 2.3.3 contain an SQL injection vulnerability in the index() formula function. A low-privileged authenticated user who can create or modify Formula fields can provide an undocumented fourth argument that is treated as a SQL template and interpolated directly into a PostgreSQL expression. The generated SQL executes through Baserow's database connection with the Baserow PostgreSQL role permissions, allowing data outside the user's workspace permissions to be read or modified.

Scores

CVSS	Score	Vector	Source
4.0	8.6 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N	Fluid Attacks

Weaknesses

CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Affected Products

Product	Versions
BaserowBaserow	2.2.0 through 2.3.3Affected

References

https://fluidattacks.com/es/advisories/superestrellathird-party-advisory
https://github.com/baserow/baserowproduct
https://github.com/baserow/baserow/commit/e7abc14975124dfe4558ff47fb8b9a25c47d9fccpatch
https://github.com/baserow/baserow/releases/tag/2.3.4release-notes

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.