PT-2026-22636 · Nocodb · Nocodb

Q1Uf3Ng

·

Published

2026-03-02

·

Updated

2026-03-25

·

CVE-2026-28399

CVSS v3.1

8.8

High

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions NocoDB versions prior to 0.301.3
Description NocoDB is software for building databases as spreadsheets. An authenticated user with a Creator role can inject arbitrary SQL code through the unit parameter of the DATEADD formula. The third argument (unit) of the DATEADD function was directly interpolated into knex.raw() queries after only stripping quote characters. Validation in formulas.ts only checked Literal AST node types, allowing non-Literal types to bypass validation. This affects MySQL, PostgreSQL, and SQLite function mappings. Successful exploitation could lead to data exfiltration or modification of the connected database.
Recommendations Versions prior to 0.301.3 should be updated to version 0.301.3 or later.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-28399
GHSA-45RP-9P97-H852

Affected Products

Nocodb