CVE-2026-126286: NocoDB before 2026.08.0 Reflected XSS via ncRedirectUrl in PageLeavingWarning.vue
NocoDB before 2026.08.0 contains a reflected cross-site scripting vulnerability in PageLeavingWarning.vue that allows unauthenticated attackers to execute script by embedding an ASCII control character in the ncRedirectUrl scheme. Attackers can send a crafted link that bypasses the scheme check and reaches the anchor href or window.location, stealing the session token from localStorage for account takeover.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated attacker can exploit it by sending a victim a crafted link. Successful exploitation requires the victim to interact with that link.
What is the impact if exploitation succeeds?
The injected script can steal a session token from localStorage, which can lead to account takeover. The reported impact includes high confidentiality and integrity impact, with no availability impact.
Which deployments are affected?
NocoDB versions before 2026.08.0 are affected. The issue is in PageLeavingWarning.vue and involves the ncRedirectUrl parameter.
What should be done to remediate the issue?
Upgrade NocoDB to version 2026.08.0 or later. Until upgrading, treat unsolicited or untrusted links containing ncRedirectUrl as potentially malicious and avoid opening them.