PT-2026-22636 · Nocodb · Nocodb

Q1Uf3Ng · Published 2026-03-02 · Updated 2026-03-25 · CVE-2026-28399

Positive Technologies · (AI Summary)

CVSS v3.1

8.8

High

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NocoDB versions prior to 0.301.3

Description NocoDB is software for building databases as spreadsheets. An authenticated user with Creator role can inject arbitrary SQL via the DATEADD formula's unit parameter. The issue affects versions prior to 0.301.3.

Recommendations Update to version 0.301.3 or later.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-28399

GHSA-45RP-9P97-H852

Affected Products

Nocodb

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28399.json · Exploit
• https://github.com/nocodb/nocodb/security/advisories/GHSA-45rp-9p97-h852 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-28399 · Security Note
• https://osv.dev/vulnerability/CVE-2026-28399 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-45rp-9p97-h852 · Vendor Advisory
• https://github.com/nocodb/nocodb · Note
• https://github.com/nocodb/nocodb/releases/tag/0.301.3 · Note
• https://twitter.com/cracbot/status/2029512429101875569 · Twitter Post
• https://twitter.com/q1uf3ng/status/2036824777642655889 · Twitter Post
• https://twitter.com/infoflowcloud/status/2028512091032731698 · Twitter Post
• https://twitter.com/CVEnew/status/2028510363537277428 · Twitter Post
• https://twitter.com/TheHackerWire/status/2029150070151778690 · Twitter Post
• https://t.me/CVEtracker/46144 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2028604200465096747 · Twitter Post
• https://twitter.com/cracbot/status/2029874892213211579 · Twitter Post