PT-2026-42673 · Git+2 · Nocodb

Naoyashiga · CVE-2026-46547 · Published 2026-05-21 · Updated 2026-06-25

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions NocoDB versions prior to 2026.04.1

Description A reflected Cross-Site Scripting (XSS) issue exists in the Page Leaving Warning page. The application reads the ncRedirectUrl and ncBackUrl query parameters from the route query without proper validation. These parameters are used in window.location.href and <a> tag bindings. When the isSameOriginUrl() function returns false, which occurs with javascript: URIs, the raw URL is assigned to window.location.href, allowing the execution of arbitrary JavaScript in the context of the application. This can be triggered by sending a crafted link to a victim and does not require authentication.

Recommendations Update to version 2026.04.1.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-46547

GHSA-9QGR-6VPG-9GH9

Affected Products

Nocodb

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46547.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-46547 · Security Note
• https://osv.dev/vulnerability/CVE-2026-46547 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9qgr-6vpg-9gh9 · Vendor Advisory
• https://github.com/nocodb/nocodb/security/advisories/GHSA-9qgr-6vpg-9gh9 · Note
• https://github.com/nocodb/nocodb · Note
• https://t.me/cveNotify/175061 · Telegram Post
• https://t.me/cveNotify/175165 · Telegram Post
• https://t.me/CVEtracker/57729 · Telegram Post
• https://t.me/cveNotify/173588 · Telegram Post