CVE-2026-28399: 
JavaScript vulnerability analysis and mitigation

CVE-2026-28399 is a SQL injection vulnerability in NocoDB, an open-source platform for building databases as spreadsheets. An authenticated user with the Creator role can inject arbitrary SQL commands via the third argument (unit parameter) of the DATEADD formula. All NocoDB versions up to and including 0.301.2 are affected across MySQL, PostgreSQL, and SQLite backends. The vulnerability was published on March 2, 2026, and patched in version 0.301.3. It carries a CVSS v3.1 base score of 8.8 (High) and a CVSS v4.0 base score of 6.2 (Medium) (GitHub Advisory, NocoDB Advisory).

The root cause (CWE-89) is improper neutralization of SQL special elements: the unit argument of the DATEADD formula was interpolated directly into knex.raw() queries after only stripping quote characters, without proper parameterization. The validation logic in formulas.ts only checked for Literal AST node types, meaning non-Literal node types entirely bypassed validation, allowing an attacker to supply a crafted expression that is evaluated as raw SQL. The attack is network-accessible, requires only low privileges (Creator role credentials), and no user interaction, making it straightforward to exploit once authenticated (NocoDB Advisory, GitHub Advisory).

Successful exploitation allows an authenticated attacker to read sensitive data from the connected database (confidentiality impact), modify or delete database records (integrity impact), and potentially disrupt database availability depending on the backend. The impact is scoped to the connected database — subsequent system components are not directly affected per the CVSS v4.0 assessment. In environments where NocoDB connects to shared or sensitive databases, this could result in significant data exfiltration or corruption (NocoDB Advisory, GitHub Advisory).

No public proof-of-concept exploit code has been identified, and there is no evidence of active in-the-wild exploitation at this time. The EPSS score is approximately 0.073% (22nd percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires valid Creator role credentials, which limits the attack surface compared to unauthenticated vulnerabilities (GitHub Advisory).

1. Obtain Creator Role Access: Authenticate to a vulnerable NocoDB instance (version ≤ 0.301.2) using an account with Creator role privileges, which may be obtained via legitimate registration, phishing, or credential compromise.
2. Navigate to Formula Input: Access a table view and open the formula editor to create or edit a formula column that uses the DATEADD function.
3. Craft Malicious Payload: Supply a malicious non-Literal AST expression as the third argument (unit parameter) of DATEADD, e.g., DATEADD(date_field, 1, <injected_sql>), where <injected_sql> contains SQL syntax that bypasses the quote-stripping validation (e.g., using subqueries or UNION statements).
4. Trigger SQL Execution: Save or evaluate the formula, causing NocoDB to interpolate the unsanitized unit parameter directly into a knex.raw() query executed against the backend database (MySQL, PostgreSQL, or SQLite).
5. Exfiltrate or Modify Data: Use the injected SQL to extract sensitive table data, enumerate database schema, or modify/delete records within the scope of the connected database (NocoDB Advisory, GitHub Advisory).

• Logs: Database query logs showing unexpected SQL syntax (e.g., UNION SELECT, subqueries, or stacked queries) originating from NocoDB formula evaluation; NocoDB application logs showing formula evaluation errors or unusual knex.raw() query patterns.
• Network: Unusual outbound connections from the NocoDB server to external hosts following formula evaluation, which may indicate data exfiltration.
• Application: Unexpected formula columns of type DATEADD with non-standard or complex unit parameter values in NocoDB table configurations; audit logs showing Creator role users creating or modifying formula columns with unusual expressions.

The primary remediation is to upgrade NocoDB to version 0.301.3 or later, which contains the fix for this vulnerability (NocoDB Release). As a defense-in-depth measure, apply the principle of least privilege by restricting Creator role assignments to only trusted and necessary users. Monitor database access logs for anomalous SQL activity. No configuration-based workaround is available that fully mitigates the vulnerability without upgrading.

The vulnerability was responsibly disclosed by researcher @q1uf3ng and acknowledged in the NocoDB 0.301.3 release notes, which also credited multiple other security researchers for separate findings in the same release (NocoDB Release). Brief social media coverage was noted on Bluesky and Mastodon via TheHackerWire shortly after disclosure. No significant broader media coverage or notable researcher commentary beyond the official advisory has been identified.