Baserow 2.3.3 contains a SQL injection flaw in the index() formula function, which internally extracts elements from a JSONB array. A low‑privileged authenticated user who can create or modify formula fields can supply an undocumented fourth argument that is treated as a raw SQL template and interpolated directly into a PostgreSQL expression. During server‑side recalculation of formula values, this generated SQL is executed via Baserow’s database connection, giving the injected query the privileges of the Baserow PostgreSQL role rather than those of the application user.

Baserow version 2.3.3 on Linux, macOS, or Windows. The vulnerability is tied to that specific release and affects deployments using these operating systems.

The CVSS score of 8.6 indicates a high severity risk. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that exploit activity may not yet have been observed at a large scale. The likely attack vector requires an attacker to be an authenticated user with permission to create or modify formula fields; the injection is delivered through a formula field during server‑side recalculation, allowing the attacker to execute arbitrary SQL with the privileges of the PostgreSQL role used by Baserow.