CVE-2026-19754

Baserow versions 2.2.0 through 2.3.3 contain an SQL injection vulnerability in the index() formula function. A low-privileged authenticated user who can create or modify Formula fields can provide an undocumented fourth argument that is treated as a SQL template and interpolated directly into a PostgreSQL expression. The generated SQL executes through Baserow's database connection with the Baserow PostgreSQL role permissions, allowing data outside the user's workspace permissions to be read or modified.

CVSS 4.0

8.6CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

EPSS

0.4% chance of exploitation in the next 30 days; higher than 33% of CVEs (scores of 2026-10-25)

CWE

CWE-89

Published

2026-09-02

Modified

2026-10-23

Record from

the NVD, synced 2026-10-24

References

• https://fluidattacks.com/es/advisories/superestrella
• https://github.com/baserow/baserow
• https://github.com/baserow/baserow/commit/e7abc14975124dfe4558ff47fb8b9a25c47d9fcc
• https://github.com/baserow/baserow/releases/tag/2.3.4
• https://fluidattacks.com/es/advisories/superestrella

Check your stackJSON