CVE-2026-46547

6.1 Moyenne

Publiée le 23/06/2026 à 23:16 · Modifiée le 25/06/2026 à 16:21 · Analyse NVD reportée · Source : security-advisories@github.com

Description

NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, a reflected XSS vulnerability exists in the Page Leaving Warning page. The ncRedirectUrl and ncBackUrl query parameters are used in window.location.href and <a> tag bindings without validation, allowing javascript: URI injection. This vulnerability is fixed in 2026.04.1.

Traduire en français

Produits concernés

nocodb

Scores CVSS

Version	Score	Source	Vecteur
3.1	6.1 Moyenne	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N`

Faiblesses (CWE)

CWE-79

Références

https://github.com/nocodb/nocodb/security/advisories/GHSA-9qgr-6vpg-9gh9

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories