{"id":"CVE-2026-126286","kind":"vulnerability","aliases":["CVE-2026-126286"],"related":[],"title":"NocoDB: crafted link runs script and steals session tokens","description":"NocoDB before 2026.08.0 contains a reflected cross-site scripting vulnerability in PageLeavingWarning.vue that allows unauthenticated attackers to execute script by embedding an ASCII control character in the ncRedirectUrl scheme. Attackers can send a crafted link that bypasses the scheme check and reaches the anchor href or window.location, stealing the session token from localStorage for account takeover.","summary":"NocoDB before 2026.08.0 has a reflected cross-site scripting flaw in its page-leaving warning component, where a control character in the redirect URL scheme bypasses the scheme check. An attacker who gets a user to open a crafted link can run script in the browser and read the session token from localStorage to take over the account.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"NocoDB","fixed":[],"affected":"","ecosystem":"vendor"},{"via":"cpe","name":"nocodb","fixed":[],"affected":"","ecosystem":"npm"}],"ecosystems":["npm","vendor"],"tags":["nocodb","other","self-hosted"],"not_affected_if":["version-2026.08.0-or-later"],"how_to_check":"- Check the NocoDB version in use; versions before `2026.08.0` are affected.","fix":"- Upgrade NocoDB to `2026.08.0` or later.","status":"open","published_at":"2026-11-13T10:17:32+00:00","first_seen_at":"2026-11-13T10:47:13+00:00","triaged_at":"2026-11-13T10:50:53+00:00","updated_at":"2026-11-13T11:20:09+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-13T10:50:53Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade NocoDB to `2026.08.0` or later.","reach":"internet","title":"NocoDB: crafted link runs script and steals session tokens","impact":"high","summary":"NocoDB before 2026.08.0 has a reflected cross-site scripting flaw in its page-leaving warning component, where a control character in the redirect URL scheme bypasses the scheme check. An attacker who gets a user to open a crafted link can run script in the browser and read the session token from localStorage to take over the account.","audience":"businesses","category":"other","nicknames":[],"who_cares":["nocodb","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Attacker steals session tokens and takes over user accounts.","analyst_note":"Confirm the affected version range and any mitigation from the vendor advisory at github.com; the sources give only the fixed version.","how_to_check":"- Check the NocoDB version in use; versions before `2026.08.0` are affected.\n- Unknown whether the sources give a further check.","plain_action":"","product_name":"NocoDB","needs_analyst":true,"not_affected_if":["version-2026.08.0-or-later"],"who_is_affected":"Any team running a self-hosted or deployed NocoDB instance older than `2026.08.0`. The flaw is in the browser UI, so exposure depends on whether users can be lured to a crafted link; the sources do not say whether a specific configuration is required.","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000744,"input_tokens":4640,"output_tokens":559,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-126286':12A,15A '-2026':11A,14A '2026.08.0':25B,85C 'account':82B,138C 'allow':97C 'anchor':127C 'ascii':106C 'attack':55B,99C,113C 'browser':70B 'bypass':50B,120C 'charact':44B,108C 'check':53B,123C 'compon':40B 'contain':86C 'control':43B,107C 'craft':2A,63B,117C 'cross':30B,90C 'cross-sit':29B,89C 'cve':10A,13A 'embed':104C 'execut':101C 'flaw':33B 'get':57B 'host':22B 'href':128C 'leav':38B 'link':3A,64B,118C 'localstorag':77B,136C 'ncredirecturl':111C 'nocodb':1A,16A,17A,18B,23B,83C 'open':61B 'page':37B 'page-leav':36B 'pageleavingwarning.vue':95C 'reach':125C 'read':72B 'redirect':47B 'reflect':28B,88C 'run':4A,66B 'scheme':49B,52B,112C,122C 'script':5A,32B,67B,92C,102C 'self':21B 'self-host':20B 'send':115C 'session':8A,74B,133C 'site':31B,91C 'steal':7A,131C 'take':79B 'takeov':139C 'token':9A,75B,134C 'unauthent':98C 'url':48B 'user':59B 'vulner':93C 'warn':39B 'window.location':130C","nicknames":[],"mitigations":[],"who_affected":"Any team running a self-hosted or deployed NocoDB instance older than `2026.08.0`. The flaw is in the browser UI, so exposure depends on whether users can be lured to a crafted link; the sources do not say whether a specific configuration is required.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["nocodb"],"ptokens":["nocodb"],"labels":["high","nocodb","npm","other","selfhosted","vendor"],"campaign_type":null,"search_a":"'-126286':12A,15A '-2026':11A,14A 'craft':2A 'cve':10A,13A 'link':3A 'nocodb':1A,16A,17A 'run':4A 'script':5A 'session':8A 'steal':7A 'token':9A","search_b":"'2026.08.0':25B 'account':82B 'attack':55B 'browser':70B 'bypass':50B 'charact':44B 'check':53B 'compon':40B 'control':43B 'craft':63B 'cross':30B 'cross-sit':29B 'flaw':33B 'get':57B 'host':22B 'leav':38B 'link':64B 'localstorag':77B 'nocodb':18B,23B 'open':61B 'page':37B 'page-leav':36B 'read':72B 'redirect':47B 'reflect':28B 'run':66B 'scheme':49B,52B 'script':32B,67B 'self':21B 'self-host':20B 'session':74B 'site':31B 'take':79B 'token':75B 'url':48B 'user':59B 'warn':39B","search_c":"'2026.08.0':85C 'account':138C 'allow':97C 'anchor':127C 'ascii':106C 'attack':99C,113C 'bypass':120C 'charact':108C 'check':123C 'contain':86C 'control':107C 'craft':117C 'cross':90C 'cross-sit':89C 'embed':104C 'execut':101C 'href':128C 'link':118C 'localstorag':136C 'ncredirecturl':111C 'nocodb':83C 'pageleavingwarning.vue':95C 'reach':125C 'reflect':88C 'scheme':112C,122C 'script':92C,102C 'send':115C 'session':133C 'site':91C 'steal':131C 'takeov':139C 'token':134C 'unauthent':98C 'vulner':93C 'window.location':130C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-27T10:06:49+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126286","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126286","severity":null,"published_at":"2026-11-13T10:17:32+00:00","modified_at":"2026-11-13T10:17:32+00:00","first_seen_at":"2026-11-13T10:47:13+00:00","fetched_at":"2026-11-13T10:47:13+00:00","note":null}],"documents":[{"id":144901,"url":"https://github.com/nocodb/nocodb/security/advisories/GHSA-x3wx-294c-4p48","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-27T10:06:49+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":144902,"url":"https://www.vulncheck.com/advisories/nocodb-before-2026.08.0-reflected-xss-via-ncredirecturl-in-pageleavingwarning-vue","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}