Moole Vulnerability Database

Find real vulnerabilities before they ship

High

CVE-2026-28399

NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, an authenticated user with Creator role can inject arbitrary SQL via the DATEADD formula's unit parameter. This issue has been patched in version 0.301.3.

VectorNETWORK

PublishedMar 02, 2026, 17:16

Published Bysecurity-advisories@github.com

Base Score

Score8.8

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

nocodb(npm)00.301.3N/A

References

https://github.com/nocodb/nocodb/releases/tag/0.301.3
https://github.com/nocodb/nocodb/security/advisories/GHSA-45rp-9p97-h852

Weakness Type

CWE-89

CVSS Metrics

Base Score

6.2

Vector String

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Base SeverityMedium

Version

4.0

Attack Vector (AV)

NETWORK