CVE-2026-28399
NoneCVSS
—
EPSS
0.6%
Published
Mar 2, 2026
CISA due date
—
The record
NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, an authenticated user with Creator role can inject arbitrary SQL via the DATEADD formula's unit parameter. This issue has been patched in version 0.301.3.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | nocodb | 0 | 0.301.3 |
Related vulnerabilities
- GHSA-45rp-9p97-h852 NocoDB Vulnerable to SQL Injection via DATEADD Formula Same vulnerability
- CVE-2026-53928 NocoDB is software for building databases as spreadsheets. Also affects nocodb
- CVE-2026-53929 NocoDB is software for building databases as spreadsheets. Also affects nocodb
- CVE-2026-53927 NocoDB is software for building databases as spreadsheets. Also affects nocodb
- CVE-2026-53930 NocoDB is software for building databases as spreadsheets. Also affects nocodb
- CVE-2026-53931 NocoDB is software for building databases as spreadsheets. Also affects nocodb
- CVE-2026-53926 NocoDB is software for building databases as spreadsheets. Also affects nocodb
- CVE-2026-47386 NocoDB is software for building databases as spreadsheets. Also affects nocodb