{"id":"CVE-2026-28399","kind":"vulnerability","aliases":["CVE-2026-28399","GHSA-45rp-9p97-h852"],"related":[],"title":"NocoDB Vulnerable to SQL Injection via DATEADD Formula","description":"### Summary\nAn authenticated user with Creator role can inject arbitrary SQL via the DATEADD formula's unit parameter.\n\n### Details\nThe third argument (unit) of `DATEADD` was interpolated directly into `knex.raw()` queries after only stripping quote characters. Validation in `formulas.ts` only checked `Literal` AST node types — non-Literal types bypassed validation entirely. Affected MySQL, PostgreSQL, and SQLite function mappings.\n\n### Impact\nSQL injection allowing data exfiltration or modification, scoped to the connected database.\n\n### Credit\nThis issue was reported by [@q1uf3ng](https://github.com/q1uf3ng).","summary":"NocoDB's DATEADD formula passes its unit argument into raw SQL after only stripping quotes, and a validation check skips non-literal inputs. An authenticated user with the Creator role can inject SQL and read or modify data in the connected database.","severity":"high","cvss":8.8,"epss":0.00362,"exploited":false,"exploited_at":null,"products":[{"name":"nocodb","fixed":["0.301.3"],"affected":"<= 0.301.2","ecosystem":"npm"},{"name":"nocodb","fixed":["0.301.3"],"affected":"< 0.301.3","ecosystem":"vendor"}],"ecosystems":["npm","vendor"],"tags":["cwe-89","mysql","nocodb","package","postgresql","self-hosted","sqlite"],"not_affected_if":["auth-required","no-creator-users"],"how_to_check":"- Check the installed NocoDB version with `npm ls nocodb` or the version shown in the NocoDB admin panel\n- Confirm whether Creator-role accounts can edit formulas in your deployment","fix":"- `nocodb` upgrade to `0.301.3` or later (fixed version per the advisory data)","status":"open","published_at":"2026-03-02T17:16:35+00:00","first_seen_at":"2026-11-05T22:31:38+00:00","triaged_at":"2026-11-05T22:31:47+00:00","updated_at":"2026-11-05T22:46:07+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-05T22:31:47Z","model":"claude-haiku-5-5","output":{"fix":"- `nocodb` upgrade to `0.301.3` or later (fixed version per the advisory data)","reach":"network","title":"NocoDB: formula DATEADD unit parameter allows SQL injection into connected database","impact":"high","summary":"NocoDB's DATEADD formula passes its unit argument into raw SQL after only stripping quotes, and a validation check skips non-literal inputs. An authenticated user with the Creator role can inject SQL and read or modify data in the connected database.","audience":"businesses","category":"package","nicknames":[],"who_cares":["nocodb","self-hosted","mysql","postgresql","sqlite"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker reads or modifies data in the connected database","analyst_note":"","how_to_check":"- Check the installed NocoDB version with `npm ls nocodb` or the version shown in the NocoDB admin panel\n- Confirm whether Creator-role accounts can edit formulas in your deployment","plain_action":"","needs_analyst":false,"not_affected_if":["auth-required","no-creator-users"],"who_is_affected":"Self-hosted or managed NocoDB instances on versions up to and including 0.301.2 that connect to MySQL, PostgreSQL or SQLite databases. Exposure requires a Creator-role account, since the flaw is triggered through formula editing. Deployments where only trusted admins hold accounts carry less risk but should still upgrade.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000721,"input_tokens":4451,"output_tokens":552,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':10A,18A '-28399':11A,19A '-89':23B '/q1uf3ng).':156C '45rp':14A '9p97':15A 'affect':127C 'allow':137C 'arbitrari':84C 'argument':39B,96C 'ast':117C 'authent':57B,77C 'bypass':124C 'charact':110C 'check':50B,115C 'connect':73B,145C 'creator':61B,80C 'credit':147C 'cve':9A,17A 'cwe':22B 'data':70B,138C 'databas':74B,146C 'dateadd':7A,34B,88C,99C 'detail':93C 'direct':102C 'entir':126C 'exfiltr':139C 'formula':8A,35B,89C 'formulas.ts':113C 'function':132C 'ghsa':13A 'ghsa-45rp-9p97-h852':12A 'github.com':155C 'github.com/q1uf3ng).':154C 'h852':16A 'host':30B 'impact':134C 'inject':5A,64B,83C,136C 'input':55B 'interpol':101C 'issu':149C 'knex.raw':104C 'liter':54B,116C,122C 'map':133C 'modif':141C 'modifi':69B 'mysql':24B,128C 'nocodb':1A,20A,21A,25B,32B 'node':118C 'non':53B,121C 'non-liter':52B,120C 'packag':26B 'paramet':92C 'pass':36B 'postgresql':27B,129C 'q1uf3ng':153C 'queri':105C 'quot':46B,109C 'raw':41B 'read':67B 'report':151C 'role':62B,81C 'scope':142C 'self':29B 'self-host':28B 'skip':51B 'sql':4A,42B,65B,85C,135C 'sqlite':31B,131C 'strip':45B,108C 'summari':75C 'third':95C 'type':119C,123C 'unit':38B,91C,97C 'user':58B,78C 'valid':49B,111C,125C 'via':6A,86C 'vulner':2A","nicknames":[],"mitigations":[],"who_affected":"Self-hosted or managed NocoDB instances on versions up to and including 0.301.2 that connect to MySQL, PostgreSQL or SQLite databases. Exposure requires a Creator-role account, since the flaw is triggered through formula editing. Deployments where only trusted admins hold accounts carry less risk but should still upgrade.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["nocodb"],"ptokens":["nocodb"],"labels":["cwe89","high","mysql","nocodb","npm","package","postgresql","selfhosted","sqlite","vendor"],"campaign_type":null,"first_public_at":"2026-03-02T14:09:48+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-45rp-9p97-h852","url":"https://github.com/advisories/GHSA-45rp-9p97-h852","severity":"medium","published_at":"2026-03-03T20:58:55+00:00","modified_at":"2026-11-05T22:28:39+00:00","first_seen_at":"2026-11-05T22:31:38+00:00","fetched_at":"2026-11-05T22:36:19+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-28399","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28399","severity":null,"published_at":"2026-03-02T17:16:35+00:00","modified_at":"2026-06-17T10:28:33+00:00","first_seen_at":"2026-11-05T22:46:07+00:00","fetched_at":"2026-11-05T22:46:07+00:00","note":null}],"documents":[{"id":80895,"url":"https://api.github.com/repos/nocodb/nocodb/security-advisories/GHSA-45rp-9p97-h852","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":80896,"url":"https://github.com/nocodb/nocodb/security/advisories/GHSA-45rp-9p97-h852","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":"2026-03-02T14:09:48+00:00","relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":80893,"url":"https://github.com/nocodb/nocodb/releases/tag/0.301.3","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"},{"id":80898,"url":"https://github.com/nocodb/nocodb/commit/8efd6b42a13d7d816c9cbda7b81da1539f9f8590","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"}],"exploit_sources":[{"type":"epss","score":0.00362,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-28399"}],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}