Vulnerability GHSA-45rp-9p97-h852
Medium Risk
MEDIUM RISK
CVSS Score: 6.0
Score Range: 4.0–6.9
Medium severity vulnerabilities (CVSS 4.0–6.9). Important issues that meaningfully reduce security confidence.
8 months ago
March 03, 2026 at 08:58 PM UTC
NocoDB Vulnerable to SQL Injection via DATEADD Formula
<0.301.3
<0.301.3
Summary
NocoDB Vulnerable to SQL Injection via DATEADD Formula
Details
Summary
An authenticated user with Creator role can inject arbitrary SQL via the DATEADD formula's unit parameter.
Details
The third argument (unit) of DATEADD was interpolated directly into knex.raw() queries after only stripping quote characters. Validation in formulas.ts only checked Literal AST node types — non-Literal types bypassed validation entirely. Affected MySQL, PostgreSQL, and SQLite function mappings.
Impact
SQL injection allowing data exfiltration or modification, scoped to the connected database.
Credit
This issue was reported by @q1uf3ng.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Medium Risk
4 months ago
NocoDB: Server-Side Request Forgery via Spreadsheet Import Endpoint
<=0.301.3 GHSA-hmcr-rmjq-47qr
<=0.301.3 GHSA-hmcr-rmjq-47qr
Medium Risk
4 months ago
NocoDB: Server-Side Request Forgery via Base Migration URL
<=0.301.3 GHSA-h6vv-pcq8-7xm4
<=0.301.3 GHSA-h6vv-pcq8-7xm4
Medium Risk
4 months ago
NocoDB: Stored Cross-Site Scripting via Secure Attachment
<=0.301.3 GHSA-6mhr-74x2-98v9
<=0.301.3 GHSA-6mhr-74x2-98v9
Medium Risk
4 months ago
NocoDB: Refresh Tokens Persist Through Password Recovery
<=0.301.3 GHSA-r989-7g3j-wjhw
<=0.301.3 GHSA-r989-7g3j-wjhw
Medium Risk
4 months ago
NocoDB: Server-Side Request Forgery via Spreadsheet Fetch URL
<=0.301.3 GHSA-gprh-27j3-g5h4
<=0.301.3 GHSA-gprh-27j3-g5h4
Impacted packages
Timeline
Published
8 months ago
March 03, 2026 at 08:58 PM UTC
Fixed (0.301.3)
8 months ago
February 27, 2026 at 12:26 PM UTC
Last Modified
9 hours ago
November 05, 2026 at 10:45 PM UTC