NocoDB SQL Injection Vulnerability in DATEADD Formula

A SQL injection vulnerability has been identified in NocoDB versions prior to 0.301.3. This issue allows authenticated users with the Creator role to inject arbitrary SQL through the DATEADD formula's unit parameter. The vulnerability arises because the unit parameter was directly interpolated into SQL queries without proper validation, leaving affected MySQL, PostgreSQL, and SQLite function mappings open to exploitation.

Impact

Exploitation of this vulnerability allows for SQL injection, enabling data exfiltration or modification within the connected database.

Remediation

Users can upgrade to NocoDB version 0.301.3 or later to address this vulnerability.