{"id":"CVE-2026-28399","aliases":["EUVD-2026-9214","GHSA-45rp-9p97-h852"],"status":"published","title":"NocoDB: SQL Injection via DATEADD Formula","description":"NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, an authenticated user with Creator role can inject arbitrary SQL via the DATEADD formula's unit parameter. This issue has been patched in version 0.301.3.","severity":{"version":"4.0","score":6.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00362,"percentile":0.30472,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-89"],"published":"2026-03-02T16:19:42Z","modified":"2026-11-05T22:45:04Z","fixes":[{"ecosystem":"npm","package":"nocodb","fixed_in":["0.301.3"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"nocodb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.301.2"},{"fixed":"0.301.3"}]}]},{"source":"osv","ecosystem":"npm","package":"nocodb","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.301.3"}]}]}],"products":[{"vendor":"nocodb","product":"nocodb"}],"references":[{"url":"https://github.com/nocodb/nocodb/security/advisories/GHSA-45rp-9p97-h852","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","web"]},{"url":"https://github.com/nocodb/nocodb/releases/tag/0.301.3","tags":["x_refsource_MISC","Product","Release Notes","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28399","tags":["advisory"]},{"url":"https://github.com/nocodb/nocodb/commit/8efd6b42a13d7d816c9cbda7b81da1539f9f8590","tags":["web"]},{"url":"https://github.com/advisories/GHSA-45rp-9p97-h852"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28399.json","tags":["advisory"]},{"url":"https://github.com/nocodb/nocodb","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-28399","title":"NocoDB: SQL Injection via DATEADD Formula","description":"NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, an authenticated user with Creator role can inject arbitrary SQL via the DATEADD formula's unit parameter. This issue has been patched in version 0.301.3.","status":"published","published":"2026-03-02T16:19:42.424Z","modified":"2026-03-03T15:53:53.938Z","cvss":[{"version":"4.0","score":6.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U","level":"medium","assessor":"cna"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:20:02.290587Z"}],"euvd":[{"id":"EUVD-2026-9214","description":"NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, an authenticated user with Creator role can inject arbitrary SQL via the DATEADD formula's unit parameter. This issue has been patched in version 0.301.3.","status":"published","published":"2026-03-02T16:19:42Z","modified":"2026-03-03T15:53:53Z","cvss":[{"version":"4.0","score":6.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U","level":"medium"}],"updated_at":"2026-11-02T19:48:11.637968Z"}],"ghsa":[{"id":"GHSA-45rp-9p97-h852","title":"NocoDB Vulnerable to SQL Injection via DATEADD Formula","description":"### Summary\nAn authenticated user with Creator role can inject arbitrary SQL via the DATEADD formula's unit parameter.\n\n### Details\nThe third argument (unit) of `DATEADD` was interpolated directly into `knex.raw()` queries after only stripping quote characters. Validation in `formulas.ts` only checked `Literal` AST node types — non-Literal types bypassed validation entirely. Affected MySQL, PostgreSQL, and SQLite function mappings.\n\n### Impact\nSQL injection allowing data exfiltration or modification, scoped to the connected database.\n\n### Credit\nThis issue was reported by [@q1uf3ng](https://github.com/q1uf3ng).","status":"published","published":"2026-03-03T20:58:55Z","modified":"2026-11-05T22:28:39Z","cvss":[{"version":"4.0","score":6.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U","level":"medium"}],"cwes":["CWE-89"],"updated_at":"2026-11-05T22:56:50.456344Z"}],"nvd":[{"id":"CVE-2026-28399","description":"NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, an authenticated user with Creator role can inject arbitrary SQL via the DATEADD formula's unit parameter. This issue has been patched in version 0.301.3.","status":"published","published":"2026-03-02T17:16:35.073Z","modified":"2026-06-17T10:28:33.123Z","cvss":[{"version":"4.0","score":6.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:12:07.420927Z"}],"osv":[{"id":"CVE-2026-28399","title":"NocoDB: SQL Injection via DATEADD Formula","description":"NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, an authenticated user with Creator role can inject arbitrary SQL via the DATEADD formula's unit parameter. This issue has been patched in version 0.301.3.","status":"published","published":"2026-03-02T16:19:42.424Z","modified":"2026-10-28T02:30:58.736753289Z","cvss":[{"version":"4.0","score":6.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U","level":"medium"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:45:00.180685Z"},{"id":"GHSA-45rp-9p97-h852","title":"NocoDB Vulnerable to SQL Injection via DATEADD Formula","description":"### Summary\nAn authenticated user with Creator role can inject arbitrary SQL via the DATEADD formula's unit parameter.\n\n### Details\nThe third argument (unit) of `DATEADD` was interpolated directly into `knex.raw()` queries after only stripping quote characters. Validation in `formulas.ts` only checked `Literal` AST node types — non-Literal types bypassed validation entirely. Affected MySQL, PostgreSQL, and SQLite function mappings.\n\n### Impact\nSQL injection allowing data exfiltration or modification, scoped to the connected database.\n\n### Credit\nThis issue was reported by [@q1uf3ng](https://github.com/q1uf3ng).","status":"published","published":"2026-03-03T20:58:55Z","modified":"2026-11-05T22:45:04.89220281Z","cvss":[{"version":"4.0","score":6.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U","level":"medium"}],"cwes":["CWE-89"],"updated_at":"2026-11-05T23:01:43.138979Z"}]}}