What’s Vulnerable › Vulnerabilities

CVE-2026-19754: Baserow 2.2.0 through 2.3.3 - SQL injection in formula index() JSONB array extraction

• Severity: high (CVSS 8.6 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-02 · updated 2026-10-23
• Weakness: CWE-89

Description

Baserow versions 2.2.0 through 2.3.3 contain an SQL injection vulnerability in the index() formula function. A low-privileged authenticated user who can create or modify Formula fields can provide an undocumented fourth argument that is treated as a SQL template and interpolated directly into a PostgreSQL expression. The generated SQL executes through Baserow's database connection with the Baserow PostgreSQL role permissions, allowing data outside the user's workspace permissions to be read or modified.

Affected products

• Baserow: from 2.2.0 through 2.3.3

References

• https://fluidattacks.com/es/advisories/superestrella
• https://github.com/baserow/baserow
• https://github.com/baserow/baserow/commit/e7abc14975124dfe4558ff47fb8b9a25c47d9fcc
• https://github.com/baserow/baserow/releases/tag/2.3.4
• https://fluidattacks.com/es/advisories/superestrella

Get alerted when CVE-2026-19754 or the next vulnerability affects your stack