CVE-2025-27506
CVE-2025-27506 · NocoDB Vulnerable to Reflected Cross-Site Scripting on Reset Password Page
This page contains facts from public vulnerability sources. Check the original advisory before updating.
NocoDB is software for building databases as spreadsheets. The API endpoint related to the password reset function is vulnerable to Reflected Cross-Site-Scripting. The endpoint /api/v1/db/auth/password/reset/:tokenId is vulnerable to Reflected Cross-Site-Scripting. The flaw occurs due to implementation of the client-side template engine ejs, specifically on file resetPassword.ts where the template is using the insecure function “<%-“, which is rendered by the function renderPasswordReset. This vulnerability is fixed in 0.258.0.
CVSS 5.4 · Medium · EPSS 0.7% · Public exploit · Fix available
- Published
- Updated
Stack: node
Affected products and versions
Original sources
- https://github.com/nocodb/nocodb/security/advisories/GHSA-wf6c-hrhf-86cw
- https://github.com/nocodb/nocodb/commit/ea821edb133e621e26183ae65c8ff9ee5d6f2723
- https://github.com/nocodb/nocodb/blob/ba5a191b33259d984fc92df225f7d82ede2ddb56/packages/nocodb/src/modules/auth/auth.controller.ts#L251
- https://github.com/nocodb/nocodb/blob/ba5a191b33259d984fc92df225f7d82ede2ddb56/packages/nocodb/src/modules/auth/ui/auth/resetPassword.ts#L71
- https://nvd.nist.gov/vuln/detail/CVE-2025-27506