CVE-2026-42259
Description
Saltcorn is an extensible, open source, no-code database application builder. Prior to versions 1.4.6, 1.5.6, and 1.6.0-beta.5, Saltcorn validates the post-login dest parameter with a string check that only blocks :/ and //. Because all WHATWG-compliant browsers normalise backslashes (\) to forward slashes (/) for special schemes, a payload such as /\evil.com/path slips through is_relative_url(), is emitted unchanged in the HTTP Location header, and causes the browser to navigate cross-origin to an attacker-controlled domain. The bug is reachable on a default install and only requires a victim who can be tricked into logging in via a crafted Saltcorn URL. This issue has been patched in versions 1.4.6, 1.5.6, and 1.6.0-beta.5.
How to fix
- @saltcorn/server1.4.6, 1.5.6, 1.6.0-beta.5 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| @saltcorn/servernpm | v < 1.4.6, 1.5.0-beta.0 ≤ v < 1.5.6, 1.6.0-alpha.0 ≤ v < 1.6.0-beta.5 | 1.4.6, 1.5.6, 1.6.0-beta.5 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.