NocoDB is software for building databases as spreadsheets. The vulnerability is a SQL injection flaw in NocoDB’s formula engine. An authenticated user with columnAdd permission on a Postgres‑backed base can inject arbitrary SQL via the optional direction argument of ARRAYSORT(...). The value is unrestricted by formula validation, is embedded into a knex.raw ORDER BY read of the formula column. This can allow the attacker to execute arbitrary queries and potentially expose or modify sensitive data. The flaw is specific to the Postgres mapping for ARRAYSORT in packages/nocodb/src/db/functionMappings/pg.ts, and it has been fixed in NocoDB 2026.04.1.

NocoDB applications running a version earlier than 2026.04.1 on a Postgres data store are affected. The flaw is linked to the Postgres mapping for ARRAYSORT in the functionMappings/pg.ts file. Users of the 2026.04.1 release or later are not vulnerable.

The flaw has a CVSS score of 6, indicating a moderate severity. The EPSS score is not available, so the current exploitation likelihood cannot be quantified, and the vulnerability is not listed in the CISA KEV catalog. The attacker must be authenticated with columnAdd permissions and have a Postgres‑backed database; the attack can be carried out during column definition or by inducing reads of the formula column, making exploitation practical in environments where users are granted this permission.