p PatchFirst

CVE-2026-46547

CVE-2026-46547 · NocoDB: Reflected Cross-Site Scripting via Page Leaving Redirect URL

This page contains facts from public vulnerability sources. Check the original advisory before updating.

NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, a reflected XSS vulnerability exists in the Page Leaving Warning page. The ncRedirectUrl and ncBackUrl query parameters are used in window.location.href and <a> tag bindings without validation, allowing javascript: URI injection. This vulnerability is fixed in 2026.04.1.

CVSS 6.1 · Medium · EPSS 0.3%

Published
Updated

Stack: node

Affected products and versions

  • nocodb

    Versions
    • < 2026.04.1: Affected

    No fix published

  • nocodb npm

    Affected ranges
    • SEMVER: ≤ 0.301.3

    No fix published

Original sources

Check your server →