PT-2026-46993 · Git+2 · Nocodb
CVSS v3.1
6.0
Medium
| Vector | AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:H |
Name of the Vulnerable Software and Affected Versions
NocoDB versions prior to 2026.04.1
Description
An authenticated user with
columnAdd permission on a Postgres-backed base can perform SQL injection within the formula engine. The issue occurs via the optional direction argument of the ARRAYSORT(...) function, where the value is not restricted by formula validation and is embedded into a knex.raw ORDER BY clause. This execution happens during column creation and every subsequent record read of the formula column. The flaw is specific to the Postgres mapping for ARRAYSORT in the packages/nocodb/src/db/functionMappings/pg.ts file. Technical analysis shows that ARRAYSORT fails to enforce an allowlist on the second argument, and the sanitize() function in sqlSanitize.ts only escapes placeholder characters without validating SQL syntax. This can lead to heavy SQL queries causing multi-second stalls, resulting in a Denial of Service (DoS), or other SQL injection outcomes depending on database permissions.Recommendations
Update to version 2026.04.1.
As a temporary workaround, restrict the
columnAdd permission to trusted users only to minimize the risk of exploitation.Exploit
Fix
SQL injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Nocodb