Stored XSS in NocoDB Password Reset via Unsanitized Token

Executive Summary

This vulnerability exists in NocoDB versions prior to 2026.04.1. The password-reset page improperly renders the URL token directly into a JavaScript string literal within a server-rendered EJS template. While EJS HTML-entity-encodes certain characters, it does not escape single quotes or backslashes. This allows a crafted token to break out of the JavaScript string context and execute attacker-controlled scripts in the NocoDB origin.

An attacker can exploit this vulnerability by tricking a victim into following a malicious password-reset link containing the crafted token.

This issue was fixed in version 2026.04.1 of NocoDB.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to the execution of attacker-controlled scripts within the context of the NocoDB origin. This means an attacker could perform cross-site scripting (XSS) attacks, potentially stealing sensitive information, hijacking user sessions, or performing actions on behalf of the victim.

The attack requires the victim to interact with a malicious password-reset link, which could be delivered via phishing or other social engineering methods.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade NocoDB to version 2026.04.1 or later, where the issue has been fixed.

Additionally, avoid clicking on or following any suspicious password-reset links until the upgrade is applied.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if the NocoDB instance is running a version prior to 2026.04.1 and if the password-reset page is vulnerable to reflected Cross-Site Scripting (XSS) via the URL token parameter.

One way to detect the vulnerability is to send a crafted password-reset URL containing a payload that attempts to break out of the JavaScript string context and execute script. For example, testing with a token parameter that includes single quotes or backslashes to see if the script executes.

Example command using curl to test the password-reset page for XSS:

• curl -v 'http://<nocodb-host>/password-reset?token='"'><script>alert(1)</script>

If the response contains the injected script or the alert is triggered when visiting the URL in a browser, the vulnerability is present.

Additionally, checking the version of NocoDB running can be done by querying the application or checking the installed package version to confirm if it is prior to 2026.04.1.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify how the CVE-2026-47376 vulnerability impacts compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0