CVE-2026-19754

Baserow 2.3.3 contains a SQL injection (CWE-89) in the index() formula function, where an undocumented fourth argument is treated as a SQL template and interpolated directly into a PostgreSQL expression. A low-privileged authenticated user who can create or modify formula fields can supply a crafted fourth argument, and the injected SQL is executed when Baserow recalculates formula field values. Because the generated SQL runs over Baserow's own database connection, the attacker's SQL executes with the privileges of the Baserow PostgreSQL role rather than the authenticated user's application permissions, potentially allowing reads or writes beyond the user's normal access. Only Baserow installations running version 2.3.3 are affected. No public proof-of-concept, in-the-wild exploitation, or KEV listing is known; EPSS estimates a 0.3% probability of exploitation in the next 30 days.

What to do: Upgrade any Baserow 2.3.3 deployment to a patched release as soon as the vendor publishes one, and track the Baserow advisory for the fixed version. Until patched, restrict formula-field creation and modification to trusted users and audit existing index() formula fields for use of a fourth argument. Review PostgreSQL logs for unexpected queries executed as the Baserow database role, which would indicate the injection has been triggered.