CVE-2026-47387

Name of the Vulnerable Software and Affected Versions NocoDB versions prior to 2026.05.1

Description The shared form-view submit handler in packages/nc-gui/composables/useSharedFormViewStore.ts fails to validate the URL scheme when writing the redirect url to window.location.href. While a same-host check is performed, non-network schemes such as javascript:, data:, vbscript:, and file: result in an empty host string, causing the application to treat the URL as an external redirect and execute it within the NocoDB origin. A user with an editor role or higher can inject a javascript: URL into the redirect url via the form-view PATCH endpoint. When an authenticated viewer submits the form through a shared link, the payload executes, allowing the attacker to read the session token from localStorage["nocodb-gui-v2"] and perform actions using the viewer's identity.

Recommendations Update to version 2026.05.1. As a temporary workaround, restrict users with the editor role from modifying the redirect url in form views until the update is applied.