NOCODB · CVE-2026-126286 · Other
NO FIX YET · SEE WHAT TO DO
NocoDB before 2026.08.0 has a reflected cross-site scripting flaw in its page-leaving warning component, where a control character in the redirect URL scheme bypasses the scheme check. An attacker who gets a user to open a crafted link can run script in the browser and read the session token from localStorage to take over the account.
first public Oct 27, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Any team running a self-hosted or deployed NocoDB instance older than 2026.08.0. The flaw is in the browser UI, so exposure depends on whether users can be lured to a crafted link; the sources do not say whether a specific configuration is required.
Not affected if version-2026.08.0-or-later
Who cares nocodb, self-hosted
2026.08.0 are affected.2026.08.0 or later.NocoDB before 2026.08.0 contains a reflected cross-site scripting vulnerability in PageLeavingWarning.vue that allows unauthenticated attackers to execute script by embedding an ASCII control character in the ncRedirectUrl scheme. Attackers can send a crafted link that bypasses the scheme check and reaches the anchor href or window.location, stealing the session token from localStorage for account takeover.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.