CVE-2026-46547: NocoDB: Reflected Cross-Site Scripting via Page Leaving Redirect URL

May 21, 2026 (updated July 20, 2026)

A reflected XSS vulnerability exists in the Page Leaving Warning page. The ncRedirectUrl and ncBackUrl query parameters are used in window.location.href and <a> tag bindings without validation, allowing javascript: URI injection.

References

github.com/advisories/GHSA-9qgr-6vpg-9gh9
github.com/nocodb/nocodb/security/advisories/GHSA-9qgr-6vpg-9gh9
nvd.nist.gov/vuln/detail/CVE-2026-46547

Code Behaviors & Features

Detect and mitigate CVE-2026-46547 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →