NocoDB versions prior to 0.301.3 contain a SQL injection vulnerability in the DATEADD formula. An authenticated user with Creator role can inject arbitrary SQL through the unit parameter of the DATEADD function due to insufficient validation. This affects MySQL, PostgreSQL, and SQLite databases connected to NocoDB. The issue is fixed in version 0.301.3.