CVE-2026-47377
CVE-2026-47377 · NocoDB: Open Redirect via Hash Fragment in hashRedirect Plugin
This page contains facts from public vulnerability sources. Check the original advisory before updating.
NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, the client-side hashRedirect plugin called window.location.replace() on a path extracted from the URL hash fragment after only checking hashPath.startsWith('/'). Protocol-relative URLs (//attacker.com/…) also satisfy that check, so a crafted link silently redirected visitors to an attacker-controlled origin. This vulnerability is fixed in 2026.04.1.
CVSS 5.1 · Medium · EPSS 0.4% · Fix available
- Published
- Updated
Stack: node