Executive brief
NocoDB is an open-source platform that turns databases into smart spreadsheets. A security flaw allows users with administrative permissions to inject malicious database commands when creating specific types of formula columns on systems using PostgreSQL. This could allow an attacker to cause significant performance slowdowns, disrupt operations, or potentially access unauthorized data within the database.
Technical details
An SQL injection vulnerability exists in NocoDB's formula engine specifically affecting PostgreSQL backends. The root cause is located in 'packages/nocodb/src/db/functionMappings/pg.ts', where the 'ARRAYSORT' function fails to validate the 'direction' argument. This user-supplied value is passed through a 'sanitize' function that only escapes placeholders and is then embedded into a 'knex.raw' ORDER BY clause. An authenticated attacker with 'columnAdd' permissions (typically Creator or Owner roles) can provide a malicious SQL payload that executes during column creation and on every subsequent record read. This can be used to perform Denial of Service (DoS) via heavy queries or potentially broader SQL injection depending on database permissions.
Affected products
- nocodb NocoDB < 2026.04.1
Timeline
- 2026-06-04: advisory: GitHub Security Advisory published
- 2026-06-23: disclosed: NVD publication date
- 2026.04.1: patched