| Package | Affected versions | Patched versions |
|---|---|---|
| nocodb | < 0.301.3 | 0.301.3 |
| nocodb | < 0.301.3 | 0.301.3 |
An authenticated user with Creator role can inject arbitrary SQL via the DATEADD formula's unit parameter.
The third argument (unit) of DATEADD was interpolated directly into knex.raw() queries after only stripping quote characters. Validation in formulas.ts only checked Literal AST node types — non-Literal types bypassed validation entirely. Affected MySQL, PostgreSQL, and SQLite function mappings.
SQL injection allowing data exfiltration or modification, scoped to the connected database.
This issue was reported by @q1uf3ng.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free