Executive brief
Baserow is an open-source no-code database platform. A low-privileged user who can create or modify formula fields can inject arbitrary SQL code through an undocumented parameter in the index() function. When Baserow recalculates formulas, the injected SQL executes with database-level privileges, potentially allowing unauthorized data access or modification.
Technical details
The vulnerability is a SQL injection flaw in Baserow's formula field processing, specifically in the index() function which extracts values from JSONB arrays. An authenticated attacker can supply an undocumented fourth argument that is interpolated directly into a PostgreSQL expression without sanitization. The injected SQL is executed during formula recalculation and runs with the privileges of the Baserow PostgreSQL database role rather than the application user's permissions, allowing privilege escalation. The attack requires authentication and the ability to create or modify formula fields, but does not require direct database access.
Affected products
- Baserow Baserow 2.3.3
Timeline
- 2026-09-02: disclosed