CVE-2026-47377: NocoDB open redirect in hashRedirect plugin

CVE-2026-47377 · Severity: medium · CVSS 4 · Published 2026-06-23

NocoDB is an open-source platform that turns databases into smart spreadsheets. A security flaw in how the application handles web links allows attackers to create malicious URLs that silently redirect users from the legitimate NocoDB site to a fraudulent website. This could be used in phishing campaigns to trick employees into entering their login credentials on a fake site that looks like the real NocoDB interface.

Technologies: nocodb (npm). Vendors: npm.

Quick answers

Is CVE-2026-47377 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-47377 being exploited in the wild.
How severe is CVE-2026-47377?
Medium severity, with a CVSS score of 4, published 23 June 2026.
Which products and versions are affected?
nocodb (npm) < 2026.04.1, ECOSYSTEM:introduced=0,fixed=2026.04.1.
Is there a fix for CVE-2026-47377?
Yes. nocodb (npm): upgrade to 2026.04.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-47377 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-47377?
Check whether you run nocodb (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • nocodb (npm): upgrade to 2026.04.1 or later
    npm install nocodb@2026.04.1

Technical details

An open redirect vulnerability exists in NocoDB's client-side hashRedirect plugin (packages/nc-gui/plugins/hashRedirect.client.ts). The application uses window.location.replace() on paths extracted from URL hash fragments. The validation logic only checked if the path started with a single forward slash ('/'), which fails to account for protocol-relative URLs (e.g., '//attacker.com'). An attacker can craft a link that, when clicked by a user, bypasses the intended local path restriction and redirects the browser to an external malicious domain. This requires no authentication and relies on user interaction. The issue is resolved in version 2026.04.1 by implementing a regex check to reject protocol-relative paths.

Affected products

  • nocodb NocoDB < 2026.04.1

Identifiers

  • CVE-2026-47377
  • GHSA-rvp5-9p55-f5rp

Timeline

  • 2026-06-04: advisory: GitHub Security Advisory published
  • 2026-06-23: disclosed: NVD publication date
  • 2026-04-01: patched: Estimated patch date based on version number 2026.04.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.