The vulnerability allows an attacker to craft URLs containing the ncRedirectUrl or ncBackUrl parameters that are inserted directly into JavaScript execution contexts and hyperlinks without validation, creating a reflected XSS condition. An attacker could execute arbitrary scripts in the victim’s browser, enabling session hijacking, cookie theft, defacement, or downstream attacks against internal resources when the victim follows the malicious link. This flaw is defined as CWE‑79, a classic input validation weakness that compromises confidentiality, integrity, and availability at the user level.

The flaw exists in all NocoDB releases prior to version 2026.04.1. Any installations that have not applied the 2026.04.1 update are vulnerable. The affected product is NocoDB by the vendor nocodb.

The CVSS score of 6.1 indicates moderate severity. The EPSS is not available, so the historical exploitation likelihood is uncertain, but reflected XSS is a well‑known attack vector in a variety of web applications, and the flaw can be triggered by a crafted URL in an email or public link. The vulnerability is not listed in CISA KEV, suggesting no known exploitation in the wild as of the last analysis. Attackers can exploit this remotely via any user who visits a malicious link that directs the victim to the Page Leaving Warning page with the malicious ncBackUrl or ncRedirectUrl values.