CVE-2026-28399: NocoDB: SQL Injection via DATEADD Formula
Summary An authenticated user with Creator role can inject arbitrary SQL via the DATEADD formula's unit parameter.
Details The third argument (unit) of DATEADD was interpolated directly into knex.raw() queries after only stripping quote characters. Validation in formulas.ts only checked Literal AST node types — non-Literal types bypassed validation entirely. Affected MySQL, PostgreSQL, and SQLite function mappings.
Impact SQL injection allowing data exfiltration or modification, scoped to the connected database.
Credit This issue was reported by @q1uf3ng.
Other sources
NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, an authenticated user with Creator role can inject arbitrary SQL via the DATEADD formula's unit parameter. This issue has been patched in version 0.301.3.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-28399?
The severity of CVE-2026-28399 is categorized as high due to the potential for arbitrary SQL injection by authenticated users.
How do I fix CVE-2026-28399?
To fix CVE-2026-28399, upgrade NocoDB to version 0.301.3 or later.
Who is affected by CVE-2026-28399?
Authenticated users with the Creator role in NocoDB versions prior to 0.301.3 are affected by CVE-2026-28399.
What impact does CVE-2026-28399 have on my database?
CVE-2026-28399 allows attackers to execute arbitrary SQL commands, potentially exposing or altering database information.
Is there a workaround for CVE-2026-28399 if I can't upgrade NocoDB?
There are no known effective workarounds for CVE-2026-28399, and upgrading is the recommended action.