PT-2026-46995 · Git+2 · Nocodb

Fg0X0 · CVE-2026-47377 · Published 2026-06-05 · Updated 2026-06-25

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions NocoDB versions prior to 2026.04.1

Description The client-side hashRedirect plugin in the packages/nc-gui/plugins/hashRedirect.client.ts file performs an insufficient check on paths extracted from the URL hash fragment. The plugin uses the startsWith('/') method to validate the hashPath variable before passing it to the window.location.replace() function. Because protocol-relative URLs (starting with //) also satisfy this condition, browsers interpret them as absolute URLs, allowing a crafted link to silently redirect users to an attacker-controlled origin. This open redirect does not require authentication and can be used to lead victims to pages that impersonate a login screen.

Recommendations Update to version 2026.04.1.

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2026-47377

GHSA-RVP5-9P55-F5RP

Affected Products

Nocodb

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47377.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-47377 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rvp5-9p55-f5rp · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-47377 · Security Note
• https://github.com/nocodb/nocodb/security/advisories/GHSA-rvp5-9p55-f5rp · Note
• https://github.com/nocodb/nocodb · Note
• https://github.com/nocodb/nocodb/releases/tag/2026.04.1 · Note
• https://t.me/cveNotify/174011 · Telegram Post
• https://t.me/cveNotify/175175 · Telegram Post