CVE-2026-46547: NocoDB Reflected XSS Vulnerability

CVE-2026-46547 Overview

CVE-2026-46547 is a reflected Cross-Site Scripting (XSS) vulnerability in NocoDB, an open-source platform that turns databases into spreadsheet-like interfaces. The flaw resides in the Page Leaving Warning page, where the ncRedirectUrl and ncBackUrl query parameters flow into window.location.href assignments and <a> tag href bindings without validation. Attackers can craft URLs containing a javascript: URI that executes in the victim's browser when the link is clicked. The issue affects NocoDB versions prior to 2026.04.1 and is tracked under [CWE-79]. Maintainers fixed the vulnerability in release 2026.04.1.

Critical Impact
Successful exploitation executes attacker-controlled JavaScript in the victim's session, enabling session theft, account takeover, and unauthorized actions within NocoDB.

Affected Products

NocoDB versions prior to 2026.04.1
Self-hosted NocoDB deployments exposing the Page Leaving Warning route
Any NocoDB instance accepting unauthenticated requests to the affected handler

Discovery Timeline

2026-06-23 - CVE-2026-46547 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-46547

Vulnerability Analysis

The vulnerability is a reflected XSS issue triggered through user-controlled query parameters. NocoDB renders a Page Leaving Warning interface when users navigate away from certain views. That page reads the ncRedirectUrl and ncBackUrl parameters directly from the URL and assigns them to window.location.href as well as to the href attribute of anchor elements. Because the values are not validated against an allowlist of safe schemes, an attacker can supply a javascript: URI that runs in the origin of the NocoDB application once a user interacts with the crafted link.

The Common Weakness Enumeration classification is [CWE-79], improper neutralization of input during web page generation. Exploitation requires user interaction, since the victim must click the malicious link or be redirected through it. The attack crosses a security boundary because the injected script executes in the NocoDB origin, granting access to session cookies, API tokens, and DOM state.

Root Cause

The root cause is missing scheme validation on redirect parameters. The application treats ncRedirectUrl and ncBackUrl as trusted URL strings and binds them to navigation sinks without filtering out dangerous schemes such as javascript:, data:, or vbscript:. Safe handling requires parsing the URL, confirming the scheme is http: or https:, and rejecting or rewriting anything else before assignment.

Attack Vector

An attacker crafts a NocoDB URL pointing at the Page Leaving Warning route with ncRedirectUrl or ncBackUrl set to a javascript: payload. The attacker delivers the link through phishing, chat, or an embedded resource. When the authenticated victim clicks the link and proceeds through the warning, the browser executes the injected script in the NocoDB origin. The payload can exfiltrate session tokens, call the NocoDB API on the victim's behalf, or pivot to stored data. See the GitHub Security Advisory for vendor-confirmed technical details.

Detection Methods for CVE-2026-46547

Indicators of Compromise

Web server or proxy logs containing ncRedirectUrl= or ncBackUrl= query parameters with values beginning in javascript:, data:, or URL-encoded variants such as javascript%3A.
Outbound browser requests from NocoDB sessions to unfamiliar domains following user clicks on shared NocoDB links.
Unexpected NocoDB API calls originating from a legitimate user session shortly after a redirect through the Page Leaving Warning page.

Detection Strategies

Inspect HTTP access logs for requests to the Page Leaving Warning endpoint that carry non-http/https schemes in the redirect parameters.
Deploy a Web Application Firewall (WAF) rule that flags or blocks query strings containing javascript: or encoded equivalents on NocoDB routes.
Enable Content Security Policy (CSP) violation reporting to capture inline script execution attempts that result from injected URIs.

Monitoring Recommendations

Alert on anomalous referrer patterns where NocoDB sessions originate from external link-shortening or phishing domains.
Monitor authentication tokens for reuse from new IP addresses or user agents after suspicious redirect activity.
Correlate browser CSP reports, WAF detections, and NocoDB audit logs to identify exploitation attempts against specific users.

How to Mitigate CVE-2026-46547

Immediate Actions Required

Upgrade all NocoDB instances to version 2026.04.1 or later, which contains the validated parameter handling.
Audit existing sessions and rotate API tokens for any user who may have clicked suspicious NocoDB links prior to patching.
Notify users to avoid following NocoDB links from untrusted sources until the upgrade is complete.

Patch Information

The vendor fixed CVE-2026-46547 in NocoDB release 2026.04.1. The patch enforces validation on ncRedirectUrl and ncBackUrl so only safe http: and https: URLs reach window.location.href and <a> bindings. Refer to the GitHub Security Advisory GHSA-9qgr-6vpg-9gh9 for full release notes and upgrade instructions.

Workarounds

Place NocoDB behind a reverse proxy that strips or rewrites ncRedirectUrl and ncBackUrl parameters containing non-HTTP schemes.
Apply a strict Content Security Policy that disallows inline script execution and blocks javascript: URIs in navigation.
Restrict access to NocoDB to authenticated users on trusted networks until the upgrade is applied.

bash

# Example NGINX rule to drop requests with javascript: in redirect parameters
if ($args ~* "(ncRedirectUrl|ncBackUrl)=(javascript|data|vbscript)(:|%3A)") {
    return 400;
}