High severity · published Mar 2, 2026
CVE-2026-28399
NocoDB: SQL Injection via DATEADD Formula
8.8
CVSS
0.3%
EPSS
No
On KEV
Description
NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, an authenticated user with Creator role can inject arbitrary SQL via the DATEADD formula's unit parameter. This issue has been patched in version 0.301.3.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 26% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NO
nocodb · nocodb
< 0.301.3 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-28399
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-28399
Product
https://github.com/nocodb/nocodb/releases/tag/0.301.3
Vendor Advisory
https://github.com/nocodb/nocodb/security/advisories/GHSA-45rp-9p97-h852
More from nocodb
9.0
CVE-2026-24769
NocoDB Vulnerable to Stored Cross-Site Scripting via SVG upload
8.8
CVE-2022-2064
Insufficient Session Expiration in GitHub repository nocodb/nocodb prior to 0.91.7+
8.8
CVE-2022-2063
Improper Privilege Management in GitHub repository nocodb/nocodb prior to 0.91.7+
8.4
CVE-2026-47387
NocoDB: Stored Cross-Site Scripting via Form View Redirect URL
8.0
CVE-2022-22121
In NocoDB, versions 0.81.0 through 0.83.8 are affected by CSV Injection vulnerability (Formula Injection)