---
id: CVE-2026-28399
aliases:
  - GHSA-45rp-9p97-h852
title: NocoDB Vulnerable to SQL Injection via DATEADD Formula
summary: NocoDB Vulnerable to SQL Injection via DATEADD Formula
severity: medium
cwe:
  - CWE-89
vendor: nocodb
product: nocodb
ecosystem: npm
affected:
  - nocodb <= 0.301.2
patched:
  - nocodb 0.301.3
published: '2026-03-03'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T22:28:39Z'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-45rp-9p97-h852'
references:
  - url: 'https://github.com/nocodb/nocodb/security/advisories/GHSA-45rp-9p97-h852'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-28399'
  - url: 'https://github.com/nocodb/nocodb/releases/tag/0.301.3'
  - url: >-
      https://github.com/nocodb/nocodb/commit/8efd6b42a13d7d816c9cbda7b81da1539f9f8590
  - url: 'https://github.com/advisories/GHSA-45rp-9p97-h852'
tags:
  - ghsa
  - npm
epss: 0.00362
epssPercentile: 0.30246
ingestedAt: '2026-11-05T22:38:31.306Z'
---

## Overview

### Summary
An authenticated user with Creator role can inject arbitrary SQL via the DATEADD formula's unit parameter.

### Details
The third argument (unit) of `DATEADD` was interpolated directly into `knex.raw()` queries after only stripping quote characters. Validation in `formulas.ts` only checked `Literal` AST node types — non-Literal types bypassed validation entirely. Affected MySQL, PostgreSQL, and SQLite function mappings.

### Impact
SQL injection allowing data exfiltration or modification, scoped to the connected database.

### Credit
This issue was reported by [@q1uf3ng](https://github.com/q1uf3ng).

## Affected packages

- `nocodb <= 0.301.2`

## Remediation

Upgrade to a patched release:

- `nocodb 0.301.3`