Description
NocoDB before 2026.08.0 contains a reflected cross-site scripting vulnerability in PageLeavingWarning.vue that allows unauthenticated attackers to execute script by embedding an ASCII control character in the ncRedirectUrl scheme. Attackers can send a crafted link that bypasses the scheme check and reaches the anchor href or window.location, stealing the session token from localStorage for account takeover.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| nocodb | nocodb | < 2026.08.0 | 2026.08.0 |
References
- GitHub Security Advisory (GHSA-x3wx-294c-4p48) vendor-advisory
- VulnCheck Advisory: NocoDB before 2026.08.0 Reflected XSS via ncRedirectUrl in PageLeavingWarning.vue third-party-advisory