CVE-2026-46547
Description
NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, a reflected XSS vulnerability exists in the Page Leaving Warning page. The ncRedirectUrl and ncBackUrl query parameters are used in window.location.href and <a> tag bindings without validation, allowing javascript: URI injection. This vulnerability is fixed in 2026.04.1.
Summary dbcve.org
NocoDB versions prior to 2026.04.1 contain a reflected XSS vulnerability in the Page Leaving Warning functionality. The ncRedirectUrl and ncBackUrl query parameters are directly used in window.location.href JavaScript bindings and <a> tag href attributes without any input validation or sanitization, allowing attackers to inject malicious javascript: URIs.
Mitigation
Upgrade to NocoDB version 2026.04.1 or later. If immediate upgrade is not possible, implement input validation to reject URLs that do not begin with http://, https://, or a relative path protocol.