VulnSocial

CVE-2026-19754Disclosure

LOWCVSS 8.6 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Baserow 2.3.3 contains a SQL injection vulnerability in the index() formula function. A low-privileged authenticated user who can create or modify formula fields can provide an undocumented fourth argument that is treated as a SQL template and interpolated directly into a PostgreSQL expression. The vulnerable expression is executed when Baserow recalculates formula field values. Because the generated SQL runs through Baserow's database connection, the injected SQL executes with the privileges of the Baserow PostgreSQL role rather than the permissions of the authenticated application user. This issue affects Baserow: 2.3.3.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-89

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Technical details provided in 1 signal
  • Disclosure: 2 classified signals
  • Peaked 1d ago at 1 mentions (2026-09-02); latest day: 1
  • 2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-09-02: 1Mentions · 2026-09-21: 1Technical Details · 2026-09-02: 109-0209-21
Signal classification1 categories
Disclosure
2100.0%
Referenced assets3 URLs
Full discourse2 posts
  • Fluid Attacks@fluidattacks
    Disclosure

    🚨 New zero-day in Baserow | Detected by our AI SAST scanner and disclosed by Miguel Gómez. As a #CNA, we assigned the ID CVE-2026-19754. Details: 🔗https://fluidattacks.com/advisories/superestrella. We have announced 275 #CVEs to this date: 🔗 https://fluidattacks.com/advisories/. https://t.co/vAcXxIGHvJ

    Post summary

    The tweet announces the discovery and CVE assignment (CVE-2026-19754) for a new zero-day vulnerability in Baserow detected by an AI SAST scanner, directing readers to an advisory for further details.

    01010102
    899 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-19754 Baserow 2.3.3 contains a SQL injection vulnerability in the index() formula function. A low-privileged authenticated user who can create or modify formula fields can … https://www.cve.org/CVERecord?id=CVE-2026-19754

    Post summary

    The post discloses a SQL injection in Baserow 2.3.3 that low‑privileged authenticated users can exploit by manipulating formula fields; it provides technical details but no proof of concept, exploitation tool, or patch information.

    000101.1K
    58.0K followersView on X

Explore more

Back to dashboard