CVE-2026-47377 NocoDB: Open Redirect via Hash Fragment in hashRedirect Plugin
Attackers can redirect users to malicious sites via crafted links due to insufficient validation of hash fragments in NocoDB.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-47377?
CVE-2026-47377 is a medium-severity vulnerability in nocodb, published on 23 Jun 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, the client-side hashRedirect plugin called window.location.replace() on a path extracted from the URL hash fragment after only checking hashPath.startsWith('/'). Protocol-relative URLs (//attacker.com/…) also satisfy that check, so a crafted link silently redirected visitors to an attacker-controlled origin. This vulnerability is fixed in 2026.04.1.
Weakness: CWE-601
Which versions are affected by CVE-2026-47377?
2 open source packages ship an affected version, including nocodb.
| Package | Affected | Fixed in |
|---|---|---|
nocodb npm | All versions | 2026.04.1 |
nocodb npm | All versions | 2026.04.1 |
How do I fix CVE-2026-47377?
Upgrade nocodb to 2026.04.1 or later.
Is CVE-2026-47377 being exploited?
There is no known exploitation of CVE-2026-47377 in the wild and no public exploit code.
Sources
Also known as GHSA-rvp5-9p55-f5rp.