CVE-2026-28399
NocoDB is software for building databases as spreadsheets.
Published Mar 2, 2026 · updated Jun 17, 2026 · nocodb nocodb
NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, an authenticated user with Creator role can inject arbitrary SQL via the DATEADD formula's unit parameter. This issue has been patched in version 0.301.3.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Mar 2, 2026 · NIST NVD
Detected
NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, an authenticated user with Creator role can inject arbitrary SQL via the DATEADD formula's unit parameter. This issue has been patched in version 0.301.3.
Jun 17, 2026 · NIST NVD
Updated
NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, an authenticated user with Creator role can inject arbitrary SQL via the DATEADD formula's unit parameter. This issue has been patched in version 0.301.3.
Affected
- cpe nocodb/nocodbversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-28399
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-28399
NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, an authenticated user with Creator role can inject arbitrary SQL via the DATEADD formula's unit parameter. This issue has been patched in version 0.301.3.
nvd.nist.gov