Executive brief
NocoDB is an open-source platform that turns databases into smart spreadsheets. A security flaw in how the application handles web links allows attackers to create malicious URLs that silently redirect users from the legitimate NocoDB site to a fraudulent website. This could be used in phishing campaigns to trick employees into entering their login credentials on a fake site that looks like the real NocoDB interface.
Technical details
An open redirect vulnerability exists in NocoDB's client-side hashRedirect plugin (packages/nc-gui/plugins/hashRedirect.client.ts). The application uses window.location.replace() on paths extracted from URL hash fragments. The validation logic only checked if the path started with a single forward slash ('/'), which fails to account for protocol-relative URLs (e.g., '//attacker.com'). An attacker can craft a link that, when clicked by a user, bypasses the intended local path restriction and redirects the browser to an external malicious domain. This requires no authentication and relies on user interaction. The issue is resolved in version 2026.04.1 by implementing a regex check to reject protocol-relative paths.
Affected products
- nocodb NocoDB < 2026.04.1
Timeline
- 2026-06-04: advisory: GitHub Security Advisory published
- 2026-06-23: disclosed: NVD publication date
- 2026-04-01: patched: Estimated patch date based on version number 2026.04.1