Baserow 2.3.3 contains a SQL injection vulnerability in the index() formula function. A low‑privileged authenticated user who can create or modify formula fields can provide an undocumented fourth argument that is treated as a SQL template and interpolated directly into a PostgreSQL expression. The generated SQL is executed through Baserow's database connection, thereby running with the privileges of the Baserow PostgreSQL role rather than those of the authenticated application user.

Baserow version 2.3.3 on Linux, macOS, or Windows. The vulnerability is tied to that specific release and affects deployments using these operating systems.

The CVSS score of 8.6 indicates a high severity risk. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that exploit activity may not yet have been observed at a large scale. The likely attack vector requires an attacker to be an authenticated user with permission to create or modify formula fields; the injection is delivered through a formula field during server‑side recalculation, allowing the attacker to execute arbitrary SQL with the privileges of the PostgreSQL role used by Baserow.