CVE-2026-47376
CVE-2026-47376 · NocoDB: Reflected Cross-Site Scripting via Password Reset Token
This page contains facts from public vulnerability sources. Check the original advisory before updating.
NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, the password-reset page rendered the URL token directly into a JavaScript string literal in a server-rendered EJS template. EJS <%= %> HTML-entity-encodes a fixed set of characters but does not escape single quotes or backslashes, so a crafted token could break out of the JS string context and execute attacker-controlled script in the NocoDB origin. Triggering required only that a victim follow a malicious password-reset link. This vulnerability is fixed in 2026.04.1.
CVSS 5.1 · Medium · EPSS 0.4% · Fix available
- Published
- Updated
Stack: node