Skip to content
CVE PROGRAM SOURCE RECORD6.2 Medium

CVE-2026-28399

NocoDB: SQL Injection via DATEADD Formula

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GitHub_M

Description

NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, an authenticated user with Creator role can inject arbitrary SQL via the DATEADD formula's unit parameter. This issue has been patched in version 0.301.3.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

nocodb nocodb

  • < 0.301.3affected

References