Executive brief
NocoDB is a free, self-hosted database management tool used as an alternative to Airtable. An authenticated user with creator permissions can inject arbitrary SQL commands through a formula feature (DATEADD), allowing them to read, modify, or delete data in the connected database. The vulnerability requires authentication but poses a significant risk to organizations relying on NocoDB to protect sensitive data.
Technical details
The vulnerability is a SQL injection flaw (CWE-89) in NocoDB's formula parsing layer. The DATEADD function's third argument (unit) is interpolated directly into knex.raw() queries after only stripping quote characters, which is insufficient sanitization. The validation logic in formulas.ts only checked Literal AST node types; non-Literal node types completely bypassed validation, allowing attackers to construct complex SQL expressions. An authenticated user with Creator role can exploit this by providing specially crafted unit parameters to extract or modify data in the underlying database (MySQL, PostgreSQL, or SQLite). The vulnerability was patched in version 0.301.3; all versions up to and including 0.301.2 are affected.
Affected products
- NocoDB NocoDB <= 0.301.2
Timeline
- 2026-03-03: disclosed: GitHub Security Advisory GHSA-45rp-9p97-h852 published
- 2026-02-27: patched: Fixed in version 0.301.3