CVE-2026-46547: NocoDB Reflected XSS in Page Leaving Warning (CVSS 6.1)

Technical summary

A reflected XSS vulnerability exists in NocoDB's Page Leaving Warning page mechanism. The vulnerability stems from improper handling of the ncRedirectUrl and ncBackUrl query parameters, which are directly bound to window.location.href assignments and <a> tag href attributes without input validation or sanitization. This allows an attacker to inject javascript: URIs that execute arbitrary JavaScript code in the security context of the victim's NocoDB session. The attack vector is network-based, requires no authentication, and depends on user interaction (clicking a link), classifying it as CVSS 3.1 Medium severity with a score of 6.1.

Business impact

If you operate NocoDB instances, this vulnerability could allow attackers to steal user session cookies, redirect users to phishing pages, or perform actions on their behalf within the database application. The attack surface is particularly broad for organizations using NocoDB as an internal tool where employees may be more likely to click internal-looking links. While the impact is limited to users who interact with crafted URLs, the ease of exploitation and low barriers to launching an attack make it a meaningful risk that warrants timely patching.

Affected systems

All NocoDB installations running versions prior to 2026.04.1 are affected. Organizations should verify their current NocoDB deployment version and identify whether the application is exposed to untrusted users or networks. The vulnerability does not require any specific configuration; it is inherent to the Page Leaving Warning functionality in vulnerable versions.

Exploitability

Exploitation requires minimal skill and resources. An attacker must craft a URL containing a javascript: URI payload in either the ncRedirectUrl or ncBackUrl parameter and convince a NocoDB user to click it. No authentication is required, and the attack succeeds when a user with an active NocoDB session clicks the malicious link. Public proof-of-concept demonstrations are not yet widely documented, but the attack pattern is straightforward and commonly understood in web security circles.

Remediation

Upgrade NocoDB to version 2026.04.1 or later, which patches the vulnerability by implementing proper input validation and output encoding for the affected query parameters. Organizations should prioritize this upgrade to maintain security posture. As an interim mitigation, restrict access to NocoDB to trusted networks or implement web application firewalls capable of detecting javascript: URI injection attempts, though upgrading is the recommended long-term solution.

Patch guidance

1. Review your current NocoDB version by checking the instance settings or deployment metadata. 2. Download version 2026.04.1 or the latest available release from the official NocoDB repository or vendor distribution channel. 3. Follow the NocoDB upgrade documentation for your deployment method (Docker, Kubernetes, self-hosted, or cloud). 4. Test the upgrade in a non-production environment first to ensure compatibility with your custom configurations or plugins. 5. Perform a phased rollout to production instances to minimize downtime. 6. After upgrade, clear user sessions to force re-authentication and ensure all active sessions are using the patched version.

Detection guidance

Monitor NocoDB server logs and web access logs for suspicious ncRedirectUrl or ncBackUrl parameter values, particularly those containing javascript:, data:, or other URI schemes that could indicate XSS injection attempts. Web application firewalls (WAF) can be configured to block requests with these patterns. Additionally, review user feedback for reports of unexpected redirects or suspicious behavior when accessing NocoDB through links in emails or messages. Endpoint detection and response (EDR) solutions may observe unusual JavaScript execution originating from browser processes accessing NocoDB if exploitation occurs.

Why prioritize this

Although rated CVSS Medium, this vulnerability should be patched promptly because it requires only user interaction to exploit, affects all pre-2026.04.1 versions without exception, and could compromise session integrity for active NocoDB users. The simplicity of crafting attack URLs and the likelihood that NocoDB users may interact with untrusted links make this a practical near-term risk, particularly in organizations where the platform is widely adopted.

Risk score, explained

The CVSS 3.1 score of 6.1 Medium reflects: network-based attack vector (AV:N), low attack complexity (AC:L), no authentication required (PR:N), user interaction necessary (UI:R), changed scope (S:C), low confidentiality impact (C:L), and low integrity impact (I:L). The score appropriately captures the balance between ease of exploitation and limited impact per incident. However, organizations with high user volumes or sensitive database content should consider their business context and risk tolerance when determining actual remediation urgency.

Frequently asked questions