GitHub Advisoryadvisory · npm

GHSA-45rp-9p97-h852 NocoDB Vulnerable to SQL Injection via DATEADD Formula

MEDIUM Published 2026-03-03 Modified 2026-03-03 Official page ↗
Aliases
CVE-2026-28399
Ecosystem
npm
Packages
nocodb
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U
Weaknesses
CWE-89
Reviewed
2026-03-03

Affected packages

• npm nocodb: < 0.301.3 → fixed in 0.301.3

Description

Summary An authenticated user with Creator role can inject arbitrary SQL via the DATEADD formula's unit parameter. Details The third argument (unit) of `DATEADD` was interpolated directly into `knex.raw()` queries after only stripping quote characters. Validation in `formulas.ts` only checked `Literal` AST node types — non-Literal types bypassed validation entirely. Affected MySQL, PostgreSQL, and SQLite function mappings. Impact SQL injection allowing data exfiltration or modification, scoped to the connected database. Credit This issue was reported by @q1uf3ng.

Related

Alias · CVE (1)

  • CVE-2026-28399 NocoDB is software for building databases as spreadsheets. vulnerability

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References