EUVD-2026-38626
GHSA-rvp5-9p55-f5rp
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (https://github.com/nocodb/nocodb) · only source for this CVE.
CVSS VectorVendor: https://github.com/nocodb/nocodb
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
Summary
The client-side hashRedirect plugin called window.location.replace() on a path extracted from the URL hash fragment after only checking hashPath.startsWith('/'). Protocol-relative URLs (//attacker.com/…) also satisfy that check, so a crafted link such as https://nocodb.example/#//attacker.com/phishing silently redirected visitors to an attacker-controlled origin.
Details
In packages/nc-gui/plugins/hashRedirect.client.ts, the plugin extracted the hash content and normalised it into cleanUrl:
let cleanUrl = hashPath.startsWith('/') ? hashPath : `/${hashPath}`
if (hashQuery) cleanUrl += `?${hashQuery}`
window.location.replace(cleanUrl)startsWith('/') returns true for //attacker.com/..., which browsers interpret as a protocol-relative absolute URL. No hostname check was performed before the redirect. The fix adds an early if (/^\/[/\\]/.test(hashPath)) return to reject protocol-relative paths.
Impact
- Open redirect from any NocoDB origin to an attacker-controlled domain.
- No authentication required; the attack lands the victim on an attacker-controlled page that may impersonate a NocoDB login.
Credit
This issue was reported by @fg0x0.
AnalysisAI
Open redirect in NocoDB's client-side hashRedirect plugin allows any attacker to silently send visitors from a legitimate NocoDB origin to an attacker-controlled domain by embedding a protocol-relative path in the URL hash fragment. All NocoDB npm releases prior to 2026.04.1 are affected; the flaw exists in packages/nc-gui/plugins/hashRedirect.client.ts where a single startsWith('/') check fails to exclude //attacker.com/... paths, which browsers resolve as absolute URLs. No public exploit has been identified at time of analysis, but the technique requires zero tooling and no authentication, making phishing campaigns against NocoDB users trivially constructable.
More in Open Redirect
View allA malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows
Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3
Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites
Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for
Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit
Share
External POC / Exploit Code
Leaving vuln.today