PT-2026-46994 · Git+2 · Nocodb
CVSS v4.0
5.1
Medium
| Vector | AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
NocoDB versions prior to 2026.04.1
Description
The password-reset page renders the URL token directly into a JavaScript string literal within a server-rendered EJS template. Because EJS
<%= %> HTML-entity-encodes only a fixed set of characters and fails to escape single quotes or backslashes, a crafted token can break out of the JavaScript string context. This allows for Reflected Cross-Site Scripting (XSS), where an attacker can execute arbitrary script in the NocoDB origin if a victim follows a malicious password-reset link. The issue occurs because the token is embedded as token: '<%= token %>', allowing a payload such as ';alert(document.cookie);// to execute. This can enable an attacker to read authentication states and act on behalf of the victim without requiring prior authentication.Recommendations
Update to version 2026.04.1.
Exploit
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Nocodb