CVE-2026-28399Medium▾ SunlitNocoDB Vulnerable to SQL Injection via DATEADD Formula
▾ Sunlit zone — Low / medium · no exploitation signal
impact 27.5 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
Last analysed / modified upstream
0.4%
An authenticated user with Creator role can inject arbitrary SQL via the DATEADD formula's unit parameter.
The third argument (unit) of DATEADD was interpolated directly into knex.raw() queries after only stripping quote characters. Validation in formulas.ts only checked Literal AST node types — non-Literal types bypassed validation entirely. Affected MySQL, PostgreSQL, and SQLite function mappings.
SQL injection allowing data exfiltration or modification, scoped to the connected database.
This issue was reported by @q1uf3ng.
nocodb <= 0.301.2Upgrade to a patched release:
nocodb 0.301.3Connected by shared product, vendor, weakness, or advisory.
CVE-2026-28361MediumNocoDB Missing Ownership Validation in MCP Token Operations
CVE-2026-28396MediumNocoDB's Refresh Tokens Not Revoked on Password Reset
CVE-2026-28360LowNocoDB has Plaintext Storage of Shared View Passwords
CVE-2026-53927MediumNocoDB: Server-Side Request Forgery via Spreadsheet Fetch URL
CVE-2026-53928MediumNocoDB: Refresh Tokens Persist Through Password Recovery
CVE-2026-53929MediumNocoDB: Stored Cross-Site Scripting via Secure Attachment