Approved changes feed: RSS · Atom
cpe:2.3:a:baserow:baserow:2.3.3:*:linux:*:*:*:*:*part: a version: 2.3.3 update: *
| Vendor | Baserow (ed5ca880-6379-5b63-b691-a73769e16c10) |
|---|---|
| Product | Baserow (8db50af2-4ade-5f86-862f-bf223756a7e3) |
| Edition | linux |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-19754 |
vulnerable | 2026-11-03 10:18:00.194122 |
Baserow 2.2.0 through 2.3.3 - SQL injection in formula index() JSONB array extraction
Baserow versions 2.2.0 through 2.3.3 contain an SQL injection vulnerability in the index() formula function. A low-privileged authenticated user who can create or modify Formula fields can provide an undocumented fourth argument that is treated as a SQL template and interpolated directly into a PostgreSQL expression. The generated SQL executes through Baserow's database connection with the Baserow PostgreSQL role permissions, allowing data outside the user's workspace permissions to be read or modified.
Published: 2026-09-02T03:29:38.759Z
Updated: 2026-10-23T18:30:35.412Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.