Quick answers
- Is CVE-2026-28399 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-28399 being exploited in the wild.
- How severe is CVE-2026-28399?
- Medium severity, with a CVSS score of 4, published 3 March 2026.
- Which products and versions are affected?
- nocodb (npm) <= 0.301.2, SEMVER:introduced=0,fixed=0.301.3.
- Is there a fix for CVE-2026-28399?
- Yes. nocodb (npm): upgrade to 0.301.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-28399 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-28399?
- Check whether you run nocodb (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- nocodb (npm): upgrade to 0.301.3 or later
npm install nocodb@0.301.3
Technical details
The vulnerability is a SQL injection flaw (CWE-89) in NocoDB's formula parsing layer. The DATEADD function's third argument (unit) is interpolated directly into knex.raw() queries after only stripping quote characters, which is insufficient sanitization. The validation logic in formulas.ts only checked Literal AST node types; non-Literal node types completely bypassed validation, allowing attackers to construct complex SQL expressions. An authenticated user with Creator role can exploit this by providing specially crafted unit parameters to extract or modify data in the underlying database (MySQL, PostgreSQL, or SQLite). The vulnerability was patched in version 0.301.3; all versions up to and including 0.301.2 are affected.
Affected products
- NocoDB NocoDB <= 0.301.2
Identifiers
- CVE-2026-28399
- GHSA-45rp-9p97-h852
Timeline
- 2026-03-03: disclosed: GitHub Security Advisory GHSA-45rp-9p97-h852 published
- 2026-02-27: patched: Fixed in version 0.301.3