A critical SQL injection vulnerability in Baserow 2.3.3 allows authenticated users to execute unauthorized database queries with elevated application-level privileges.

This flaw involves an improper neutralization of special elements used in an SQL command (CWE-89). An authenticated user with sufficient permissions to modify formula fields can inject a malicious fourth argument into the index() function, which is then interpolated into a PostgreSQL expression and executed by the application database service.

The ability to perform SQL injection poses a severe risk to data confidentiality and integrity, as an attacker can bypass application logic to read, modify, or delete sensitive data stored within the database. With a CVSS score of 8.6, this high-severity vulnerability could lead to a total compromise of the application backend. Organizations should consider this an urgent threat to their data assets and internal system security.

Immediate Action: Monitor official Baserow security advisories and the GitHub repository for the release of a patched version of the software.

Proactive Monitoring: Review database audit logs for anomalous query patterns or unexpected execution of SQL functions linked to formula field recalculations.

Compensating Controls: Restrict the ability of low-privileged users to create or modify formula fields as a temporary measure until a patch is applied.

Public Exploit Available: Unknown.

Given the high CVSS score and the nature of the vulnerability, administrators must prioritize the protection of the database layer. As a patch is not yet explicitly identified, organizations should restrict user access to formula-related features and maintain heightened vigilance over database logs. Apply the vendor-provided update immediately upon release to remediate the underlying code vulnerability.