PT-2026-46995 · Npm · Nocodb

Published

2026-06-05

·

Updated

2026-06-05

·

CVE-2026-47377

CVSS v4.0

5.1

Medium

VectorAV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Summary

The client-side hashRedirect plugin called window.location.replace() on a path extracted from the URL hash fragment after only checking hashPath.startsWith('/'). Protocol-relative URLs (//attacker.com/…) also satisfy that check, so a crafted link such as https://nocodb.example/#//attacker.com/phishing silently redirected visitors to an attacker-controlled origin.

Details

In packages/nc-gui/plugins/hashRedirect.client.ts, the plugin extracted the hash content and normalised it into cleanUrl:
let cleanUrl = hashPath.startsWith('/') ? hashPath : `/${hashPath}`
if (hashQuery) cleanUrl += `?${hashQuery}`
window.location.replace(cleanUrl)
startsWith('/') returns true for //attacker.com/..., which browsers interpret as a protocol-relative absolute URL. No hostname check was performed before the redirect. The fix adds an early if (/^/[/]/.test(hashPath)) return to reject protocol-relative paths.

Impact

  • Open redirect from any NocoDB origin to an attacker-controlled domain.
  • No authentication required; the attack lands the victim on an attacker-controlled page that may impersonate a NocoDB login.

Credit

This issue was reported by @fg0x0.

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2026-47377
GHSA-RVP5-9P55-F5RP

Affected Products

Nocodb