Baserow 2.3.3 contains a SQL injection vulnerability in the index() formula function. (CVE-2026-19754)

The vulnerability in Baserow 2.3.3 arises from the index() formula function allowing a low-privileged authenticated user to supply an undocumented fourth argument. This argument is treated as a SQL template and directly interpolated into a PostgreSQL expression without proper sanitization. The resulting SQL executes with the database role privileges of Baserow's PostgreSQL connection rather than the limited permissions of the authenticated user. This SQL injection (CWE-89) can lead to unauthorized database operations. No patch or remediation information is provided in the available data.

An attacker with low-privileged authenticated access who can create or modify formula fields can execute arbitrary SQL commands on the Baserow database with elevated privileges. This can lead to unauthorized data access, modification, or other malicious database operations. The vulnerability elevates the attacker's capabilities beyond their application-level permissions due to the SQL execution context.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict the ability to create or modify formula fields to trusted users only. Monitor vendor channels for updates and apply patches promptly once released.