CVE-2026-47376

Name of the Vulnerable Software and Affected Versions NocoDB versions prior to 2026.04.1

Description The password-reset page renders the URL token directly into a JavaScript string literal within a server-rendered EJS template. Because EJS <%= %> HTML-entity-encodes only a fixed set of characters and fails to escape single quotes or backslashes, a crafted token can break out of the JavaScript string context. This allows for Reflected Cross-Site Scripting (XSS), where an attacker can execute arbitrary script in the NocoDB origin if a victim follows a malicious password-reset link. The issue occurs because the token is embedded as token: '<%= token %>', allowing a payload such as ';alert(document.cookie);// to execute. This can enable an attacker to read authentication states and act on behalf of the victim without requiring prior authentication.

Recommendations Update to version 2026.04.1.