CVE-2026-47376CWE-79

NocoDB: Reflected Cross-Site Scripting via Password Reset Token

Medium · published June 23, 2026

CVSS v4.0
5.1
EPSS
0%
Percentile
37.5
In the wild
Unconfirmed
What it is

NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, the password-reset page rendered the URL token directly into a JavaScript string literal in a server-rendered EJS template. EJS <%= %> HTML-entity-encodes a fixed set of characters but does not escape single quotes or backslashes, so a crafted token could break out of the JS string context and execute attacker-controlled script in the NocoDB origin. Triggering required only that a victim follow a malicious password-reset link. This vulnerability is fixed in 2026.04.1.

The record
Technical detail
CVSS v4.0
5.1 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00444 · 37.5th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-06-23T20:35Z
EPSS history
Timeline
  • 23 JUN 20:35Z
    NocoDB: Reflected Cross-Site Scripting via Password Reset Token
    cvelistv5