Is CVE-2026-42259 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-42259 being exploited in the wild.

How severe is CVE-2026-42259?

Medium severity, with a CVSS score of 4, published 16 April 2026.

Which products and versions are affected?

@saltcorn/server (npm) SEMVER:introduced=0,fixed=1.4.6; Saltcorn = 1.5.0-beta.0 = 1.6.0-alpha.0 < 1.6.0-beta.5.

Is there a fix for CVE-2026-42259?

Yes. @saltcorn/server (npm): upgrade to 1.4.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-42259 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-42259?

Check whether you run @saltcorn/server (npm) or Saltcorn at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-42259: Saltcorn open redirect in login via backslash bypass

Q: Is there a fix for CVE-2026-42259?

Yes. @saltcorn/server (npm): upgrade to 1.4.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-42259 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-42259?

Check whether you run @saltcorn/server (npm) or Saltcorn at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-42259 · Severity: medium · CVSS 4 · Published 2026-04-16

Saltcorn, an open-source no-code database application builder, is vulnerable to an open redirect flaw during the login process. An attacker can trick a user into clicking a specially crafted link that, after a successful login, redirects the user to a malicious website. This can be used for phishing attacks to steal user credentials by mimicking a legitimate session timeout or login prompt.

Technologies: @saltcorn/server (npm), Saltcorn. Vendors: npm, Saltcorn.

Quick answers

Is CVE-2026-42259 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-42259 being exploited in the wild.
How severe is CVE-2026-42259?: Medium severity, with a CVSS score of 4, published 16 April 2026.
Which products and versions are affected?: @saltcorn/server (npm) SEMVER:introduced=0,fixed=1.4.6; Saltcorn < 1.4.6, >= 1.5.0-beta.0 < 1.5.6, >= 1.6.0-alpha.0 < 1.6.0-beta.5.
Is there a fix for CVE-2026-42259?: Yes. @saltcorn/server (npm): upgrade to 1.4.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-42259 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-42259?: Check whether you run @saltcorn/server (npm) or Saltcorn at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@saltcorn/server (npm): upgrade to 1.4.6 or later
```
npm install @saltcorn/server@1.4.6
```

Technical details

An open redirect vulnerability exists in Saltcorn's `POST /auth/login` route due to a bypass in the `is_relative_url` validation function. The function only checks for the presence of `:/` and `//` to identify absolute URLs, failing to account for backslashes (`\`) which modern WHATWG-compliant browsers normalize to forward slashes. An attacker can provide a payload like `/\evil.com/path` which passes the check but causes a cross-origin redirect. Additionally, the function fails to block non-http schemes like `javascript:` or `data:`. The vulnerability is patched in versions 1.4.6, 1.5.6, and 1.6.0-beta.5.

Affected products

Saltcorn Saltcorn < 1.4.6, >= 1.5.0-beta.0 < 1.5.6, >= 1.6.0-alpha.0 < 1.6.0-beta.5

Identifiers

CVE-2026-42259
GHSA-f3g8-9xv5-77gv

Timeline

2026-04-16: advisory
2026-04-16: disclosed
2026-05-07: kev added: NVD Published Date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.