NocoDB: Reflected Cross-Site Scripting via Password Reset Token
Summary
The password-reset page rendered the URL token directly into a JavaScript string literal in a server-rendered EJS template. EJS <%= %> HTML-entity-encodes a fixed set of characters but does not escape single quotes or backslashes, so a crafted token could break out of the JS string context and execute attacker-controlled script in the NocoDB origin. Triggering required only that a victim follow a malicious password-reset link.
Details
The vulnerable template embedded the token as:
token: '<%= token %>',A token containing ';alert(document.cookie);// closes the single-quoted string and runs arbitrary JavaScript. The fix moves the token into an HTML attribute (data-token="…") and reads it from dataset.token at runtime, so EJS's HTML-entity escaping is sufficient.
Impact
- Reflected XSS in the NocoDB origin via a phished password-reset URL.
- No authentication required to trigger; affects any user who clicks the crafted link.
- Same-origin script can read auth state and act on the victim's behalf.
Credit
This issue was reported by @fg0x0.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | nocodb | < 2026.04.1 | 2026.04.1 |
References
- CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N- Weakness (CWE)
CWE-79- Platform
- npm
- Package
nocodb- Disclosed
- 05.06.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-6xcx-7qmg-vjfq - CC BY 4.0
Vulnerability history: nocodb
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 54
- First → latest
- 06.2022 06.2026
- Without a fix
- 13
- Exploited in attacks
- 0
Severity breakdown
- High 7
- Medium 41
- Low 6
Disclosures per year
- 2022: 5
- 2023: 2
- 2024: 3
- 2025: 1
- 2026: 43
-
NocoDB: Reflected Cross-Site Scripting via Password Reset Token this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.