---
id: "CVE-2026-28399"
page: "https://infrastack.ai/live/CVE-2026-28399"
kind: "vulnerability"
aliases: ["CVE-2026-28399", "GHSA-45rp-9p97-h852"]
title: "NocoDB Vulnerable to SQL Injection via DATEADD Formula"
severity: "high"
cvss: 8.8
epss: 0.00362
exploited: false
status: "open"
category: "package"
products: [{"name": "nocodb", "fixed": ["0.301.3"], "affected": "<= 0.301.2", "ecosystem": "npm"}, {"name": "nocodb", "fixed": ["0.301.3"], "affected": "< 0.301.3", "ecosystem": "vendor"}]
ecosystems: ["npm", "vendor"]
tags: ["cwe-89", "mysql", "nocodb", "package", "postgresql", "self-hosted", "sqlite"]
not_affected_if: ["auth-required", "no-creator-users"]
published_at: "2026-03-02T17:16:35+00:00"
first_seen_at: "2026-11-05T22:31:38+00:00"
updated_at: "2026-11-05T22:46:07+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-45rp-9p97-h852", "first_seen_at": "2026-11-05T22:31:38+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28399", "first_seen_at": "2026-11-05T22:46:07+00:00"}]
exploit_sources: [{"type": "epss", "score": 0.00362, "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-28399"}]
---

# NocoDB Vulnerable to SQL Injection via DATEADD Formula

Link for people: https://infrastack.ai/live/CVE-2026-28399 (this .md is for agents)

NocoDB's DATEADD formula passes its unit argument into raw SQL after only stripping quotes, and a validation check skips non-literal inputs. An authenticated user with the Creator role can inject SQL and read or modify data in the connected database.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:nocodb affected <= 0.301.2 fixed 0.301.3
- vendor:nocodb affected < 0.301.3 fixed 0.301.3

## How to check

- Check the installed NocoDB version with `npm ls nocodb` or the version shown in the NocoDB admin panel
- Confirm whether Creator-role accounts can edit formulas in your deployment

## Fix

- `nocodb` upgrade to `0.301.3` or later (fixed version per the advisory data)

## Timeline

- 2026-11-05T22:31:38+00:00 ghsa https://github.com/advisories/GHSA-45rp-9p97-h852
- 2026-11-05T22:46:07+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-28399

## Documents

- [advisory] Maintainer's advisory: api.github.com https://api.github.com/repos/nocodb/nocodb/security-advisories/GHSA-45rp-9p97-h852
- [advisory] Maintainer's advisory: github.com https://github.com/nocodb/nocodb/security/advisories/GHSA-45rp-9p97-h852
- [fix] Release: github.com https://github.com/nocodb/nocodb/releases/tag/0.301.3
- [fix] Patch: github.com https://github.com/nocodb/nocodb/commit/8efd6b42a13d7d816c9cbda7b81da1539f9f8590

## From the sources

### Summary
An authenticated user with Creator role can inject arbitrary SQL via the DATEADD formula's unit parameter.

### Details
The third argument (unit) of `DATEADD` was interpolated directly into `knex.raw()` queries after only stripping quote characters. Validation in `formulas.ts` only checked `Literal` AST node types — non-Literal types bypassed validation entirely. Affected MySQL, PostgreSQL, and SQLite function mappings.

### Impact
SQL injection allowing data exfiltration or modification, scoped to the connected database.

### Credit
This issue was reported by [@q1uf3ng](https://github.com/q1uf3ng).

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_