Executive brief
NocoDB, a platform that turns databases into smart spreadsheets, is vulnerable to a security flaw where attackers can run malicious code in a user's browser. By tricking a user into clicking a specially crafted link, an attacker could potentially steal session information or perform unauthorized actions on the user's behalf. This issue occurs on the page that warns users when they are leaving the application.
Technical details
A reflected cross-site scripting (XSS) vulnerability exists in NocoDB's PageLeavingWarning.vue component. The application fails to validate the 'ncRedirectUrl' and 'ncBackUrl' query parameters before using them in window.location.href and <a> tag bindings. Because the isSameOriginUrl() check fails to account for 'javascript:' URIs, an attacker can inject malicious scripts that execute when a user interacts with the page. This is a network-based attack requiring user interaction (clicking a link) but no prior authentication. The issue is resolved in version 2026.04.1.
Affected products
- NocoDB NocoDB < 2026.04.1
Timeline
- 2026-05-19: advisory: GitHub Security Advisory published
- 2026-06-23: disclosed: CVE published to NVD
- 2026-04-01: patched: Estimated patch date based on version number 2026.04.1