CVE-2026-126286 — NOCODB
HIGHCVE-2026-126286 is a high-severity (CVSS 8.1) Cross-site Scripting (XSS) vulnerability in nocodb nocodb. A fix is available — see the affected versions and patch details below.
NocoDB before 2026.08.0 contains a reflected cross-site scripting vulnerability in PageLeavingWarning.vue that allows unauthenticated attackers to execute script by embedding an ASCII…
Description
NocoDB before 2026.08.0 contains a reflected cross-site scripting vulnerability in PageLeavingWarning.vue that allows unauthenticated attackers to execute script by embedding an ASCII control character in the ncRedirectUrl scheme. Attackers can send a crafted link that bypasses the scheme check and reaches the anchor href or window.location, stealing the session token from localStorage for account takeover.
Affected Products
nocodbnocodbDetection & mitigation playbook
Vendor / applianceDetect
Inventory every nocodb nocodb deployment and check each version against the affected-products list above.
Fix
Apply the nocodb nocodb security patch or hotfix for CVE-2026-126286 on the affected version, following the vendor advisory for your exact build.
Workarounds
Escape or sanitise the affected output on the server side rather than relying on client-side filtering, and add a Content-Security-Policy that blocks inline script execution so injected markup cannot run even if it reaches the page. Alongside that, restrict the management interface to trusted networks and apply the vendor's recommended configuration mitigations.
Frequently Asked Questions
Is CVE-2026-126286 being exploited in your environment?
Detect and block the exploit chain at execution, on systems you cannot patch yet.