Monitor vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.6

NocoDB SQL Injection via Date Formula

CVE-2026-28399 GHSA-45rp-9p97-h852 GHSA-45rp-9p97-h852
Summary

An authenticated user with Creator role can inject malicious code into NocoDB's database, potentially allowing them to steal or modify data. This is a serious issue because it allows unauthorized access to sensitive information. To protect your data, update to the latest version of NocoDB.

What to do
  • Update pranavxc nocodb to version 0.301.3.
Affected software
VendorProductAffected versionsFix available
pranavxc nocodb <= 0.301.2 0.301.3
nocodb nocodb <= 0.301.3
pranavxc nocodb <= 0.301.3 0.301.3
Original title
NocoDB Vulnerable to SQL Injection via DATEADD Formula
Original description
### Summary
An authenticated user with Creator role can inject arbitrary SQL via the DATEADD formula's unit parameter.

### Details
The third argument (unit) of `DATEADD` was interpolated directly into `knex.raw()` queries after only stripping quote characters. Validation in `formulas.ts` only checked `Literal` AST node types — non-Literal types bypassed validation entirely. Affected MySQL, PostgreSQL, and SQLite function mappings.

### Impact
SQL injection allowing data exfiltration or modification, scoped to the connected database.

### Credit
This issue was reported by [@q1uf3ng](https://github.com/q1uf3ng).
nvd CVSS3.1 8.8
nvd CVSS4.0 6.2
Vulnerability type
CWE-89 SQL Injection
Published: 3 Mar 2026 · Updated: 13 Mar 2026 · First seen: 6 Mar 2026