CVE-2026-46547: NocoDB reflected XSS in Page Leaving Warning page

CVE-2026-46547 · Severity: medium · CVSS 6.1 · Published 2026-06-23

NocoDB, a platform that turns databases into smart spreadsheets, is vulnerable to a security flaw where attackers can run malicious code in a user's browser. By tricking a user into clicking a specially crafted link, an attacker could potentially steal session information or perform unauthorized actions on the user's behalf. This issue occurs on the page that warns users when they are leaving the application.

Technologies: nocodb (npm). Vendors: npm.

Quick answers

Is CVE-2026-46547 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-46547 being exploited in the wild.
How severe is CVE-2026-46547?
Medium severity, with a CVSS score of 6.1, published 23 June 2026.
Which products and versions are affected?
nocodb (npm) <= 0.301.3, SEMVER:introduced=0,last_affected=0.301.3.
Is there a fix for CVE-2026-46547?
A patch was published on 2026-04-01: Estimated patch date based on version number 2026.04.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-46547 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-46547?
Check whether you run nocodb (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A reflected cross-site scripting (XSS) vulnerability exists in NocoDB's PageLeavingWarning.vue component. The application fails to validate the 'ncRedirectUrl' and 'ncBackUrl' query parameters before using them in window.location.href and <a> tag bindings. Because the isSameOriginUrl() check fails to account for 'javascript:' URIs, an attacker can inject malicious scripts that execute when a user interacts with the page. This is a network-based attack requiring user interaction (clicking a link) but no prior authentication. The issue is resolved in version 2026.04.1.

Affected products

  • NocoDB NocoDB < 2026.04.1

Identifiers

  • CVE-2026-46547
  • GHSA-9qgr-6vpg-9gh9

Timeline

  • 2026-05-19: advisory: GitHub Security Advisory published
  • 2026-06-23: disclosed: CVE published to NVD
  • 2026-04-01: patched: Estimated patch date based on version number 2026.04.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.