NOCODB · CVE-2026-28399 · Package
FIX → 0.301.3
NocoDB's DATEADD formula passes its unit argument into raw SQL after only stripping quotes, and a validation check skips non-literal inputs. An authenticated user with the Creator role can inject SQL and read or modify data in the connected database.
first public Mar 2, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Self-hosted or managed NocoDB instances on versions up to and including 0.301.2 that connect to MySQL, PostgreSQL or SQLite databases. Exposure requires a Creator-role account, since the flaw is triggered through formula editing. Deployments where only trusted admins hold accounts carry less risk but should still upgrade.
Not affected if auth-required, no-creator-users
Who cares cwe-89, mysql, nocodb, postgresql, self-hosted, sqlite
npm ls nocodb or the version shown in the NocoDB admin panelUpgrade to 0.301.3
nocodb upgrade to or later (fixed version per the advisory data)An authenticated user with Creator role can inject arbitrary SQL via the DATEADD formula's unit parameter.
The third argument (unit) of DATEADD was interpolated directly into knex.raw() queries after only stripping quote characters. Validation in formulas.ts only checked Literal AST node types — non-Literal types bypassed validation entirely. Affected MySQL, PostgreSQL, and SQLite function mappings.
SQL injection allowing data exfiltration or modification, scoped to the connected database.
This issue was reported by @q1uf3ng.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
0.301.3This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.