{"id":"CVE-2025-27506","aliases":["EUVD-2025-7786","GHSA-wf6c-hrhf-86cw"],"status":"published","title":"NocoDB Vulnerable to Reflected Cross-Site Scripting on Reset Password Page","description":"NocoDB is software for building databases as spreadsheets. The API endpoint related to the password reset function is vulnerable to Reflected Cross-Site-Scripting. The endpoint /api/v1/db/auth/password/reset/:tokenId is vulnerable to Reflected Cross-Site-Scripting. The flaw occurs due to implementation of the client-side template engine ejs, specifically on file resetPassword.ts where the template is using the insecure function “\u003c%-“, which is rendered by the function renderPasswordReset. This vulnerability is fixed in 0.258.0.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00711,"percentile":0.54,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2025-03-06T18:52:10Z","modified":"2026-10-28T02:31:09Z","exploits":[{"source":"nuclei","id":"CVE-2025-27506","title":"NocoDB \u003c 0.258.0 - Reflected XSS in Password Reset","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-27506.yaml"}],"fixes":[{"ecosystem":"npm","package":"nocodb","fixed_in":["0.258.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"nocodb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.258.0"}]}]},{"source":"osv","ecosystem":"npm","package":"nocodb","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.258.0"}]}]}],"products":[{"vendor":"nocodb","product":"nocodb"}],"references":[{"url":"https://github.com/nocodb/nocodb/security/advisories/GHSA-wf6c-hrhf-86cw","tags":["x_refsource_CONFIRM","Exploit","Vendor Advisory","advisory","web"]},{"url":"https://github.com/nocodb/nocodb/commit/ea821edb133e621e26183ae65c8ff9ee5d6f2723","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/nocodb/nocodb/blob/ba5a191b33259d984fc92df225f7d82ede2ddb56/packages/nocodb/src/modules/auth/auth.controller.ts#L251","tags":["x_refsource_MISC","Product","web"]},{"url":"https://github.com/nocodb/nocodb/blob/ba5a191b33259d984fc92df225f7d82ede2ddb56/packages/nocodb/src/modules/auth/ui/auth/resetPassword.ts#L71","tags":["x_refsource_MISC","Product","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-27506","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-wf6c-hrhf-86cw"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/27xxx/CVE-2025-27506.json","tags":["advisory"]},{"url":"https://github.com/nocodb/nocodb","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-27506","title":"NocoDB Vulnerable to Reflected Cross-Site Scripting on Reset Password Page","description":"NocoDB is software for building databases as spreadsheets. The API endpoint related to the password reset function is vulnerable to Reflected Cross-Site-Scripting. The endpoint /api/v1/db/auth/password/reset/:tokenId is vulnerable to Reflected Cross-Site-Scripting. The flaw occurs due to implementation of the client-side template engine ejs, specifically on file resetPassword.ts where the template is using the insecure function “\u003c%-“, which is rendered by the function renderPasswordReset. This vulnerability is fixed in 0.258.0.","status":"published","published":"2025-03-06T18:52:10.371Z","modified":"2025-03-06T19:19:39.656Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:32:42.751171Z"}],"euvd":[{"id":"EUVD-2025-7786","description":"NocoDB is software for building databases as spreadsheets. The API endpoint related to the password reset function is vulnerable to Reflected Cross-Site-Scripting. The endpoint /api/v1/db/auth/password/reset/:tokenId is vulnerable to Reflected Cross-Site-Scripting. The flaw occurs due to implementation of the client-side template engine ejs, specifically on file resetPassword.ts where the template is using the insecure function “\u003c%-“, which is rendered by the function renderPasswordReset. This vulnerability is fixed in 0.258.0.","status":"published","published":"2025-03-06T18:52:10Z","modified":"2025-03-06T19:19:39Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T20:53:11.059252Z"}],"ghsa":[{"id":"GHSA-wf6c-hrhf-86cw","title":"NocoDB Vulnerable to Reflected Cross-Site Scripting on Reset Password Page","description":"### Summary\n\nThe API endpoint related to the password reset function is vulnerable to Reflected Cross-Site-Scripting. \n\n### Details\n\nThroughout the source-code analysis, it has been found that the endpoint /api/v1/db/auth/password/reset/:tokenId is vulnerable to Reflected Cross-Site-Scripting.\n \nThe flaw occurs due to implementation of the client-side template engine ejs, specifically on file resetPassword.ts where the template is using the insecure function “\u003c%-“ \nhttps://github.com/nocodb/nocodb/blob/ba5a191b33259d984fc92df225f7d82ede2ddb56/packages/nocodb/src/modules/auth/ui/auth/resetPassword.ts#L71  \nwhich is rendered by the function renderPasswordReset: \nhttps://github.com/nocodb/nocodb/blob/ba5a191b33259d984fc92df225f7d82ede2ddb56/packages/nocodb/src/modules/auth/auth.controller.ts#L251\n\n### PoC\n\nSend the request below to a vulnerable instance: \n`/api/v1/db/auth/password/reset/asdsad%3C%2F%73%63%72%69%70%74%3E%3C%73%63%72%69%70%74%3E%61%6C%65%72%74%28%31%29%3C%2F%73%63%72%69%70%74%3E/`\n\n![image](https://github.com/user-attachments/assets/28d8e7c6-efb9-49df-b049-56dab229d74f)\n\n### Impact\n\nThe vulnerability affect end-users, allowing an attacker to craft and send a malicious link to the victim which leads running script on their browser.\n\n### Credits\n[l34k3d](https://github.com/xL34K3D)\n[ottoboni](https://github.com/gabrielott)","status":"published","published":"2025-03-06T18:52:17Z","modified":"2025-08-26T15:39:59Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:38:54.795089Z"}],"nvd":[{"id":"CVE-2025-27506","description":"NocoDB is software for building databases as spreadsheets. The API endpoint related to the password reset function is vulnerable to Reflected Cross-Site-Scripting. The endpoint /api/v1/db/auth/password/reset/:tokenId is vulnerable to Reflected Cross-Site-Scripting. The flaw occurs due to implementation of the client-side template engine ejs, specifically on file resetPassword.ts where the template is using the insecure function “\u003c%-“, which is rendered by the function renderPasswordReset. This vulnerability is fixed in 0.258.0.","status":"published","published":"2025-03-06T19:15:27.833Z","modified":"2026-06-17T09:03:43.467Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:10:53.101324Z"}],"osv":[{"id":"CVE-2025-27506","title":"NocoDB Vulnerable to Reflected Cross-Site Scripting on Reset Password Page","description":"NocoDB is software for building databases as spreadsheets. The API endpoint related to the password reset function is vulnerable to Reflected Cross-Site-Scripting. The endpoint /api/v1/db/auth/password/reset/:tokenId is vulnerable to Reflected Cross-Site-Scripting. The flaw occurs due to implementation of the client-side template engine ejs, specifically on file resetPassword.ts where the template is using the insecure function “\u003c%-“, which is rendered by the function renderPasswordReset. This vulnerability is fixed in 0.258.0.","status":"published","published":"2025-03-06T18:52:10.371Z","modified":"2026-10-28T02:31:09.085597409Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:44:47.708311Z"},{"id":"GHSA-wf6c-hrhf-86cw","title":"NocoDB Vulnerable to Reflected Cross-Site Scripting on Reset Password Page","description":"### Summary\n\nThe API endpoint related to the password reset function is vulnerable to Reflected Cross-Site-Scripting. \n\n### Details\n\nThroughout the source-code analysis, it has been found that the endpoint /api/v1/db/auth/password/reset/:tokenId is vulnerable to Reflected Cross-Site-Scripting.\n \nThe flaw occurs due to implementation of the client-side template engine ejs, specifically on file resetPassword.ts where the template is using the insecure function “\u003c%-“ \nhttps://github.com/nocodb/nocodb/blob/ba5a191b33259d984fc92df225f7d82ede2ddb56/packages/nocodb/src/modules/auth/ui/auth/resetPassword.ts#L71  \nwhich is rendered by the function renderPasswordReset: \nhttps://github.com/nocodb/nocodb/blob/ba5a191b33259d984fc92df225f7d82ede2ddb56/packages/nocodb/src/modules/auth/auth.controller.ts#L251\n\n### PoC\n\nSend the request below to a vulnerable instance: \n`/api/v1/db/auth/password/reset/asdsad%3C%2F%73%63%72%69%70%74%3E%3C%73%63%72%69%70%74%3E%61%6C%65%72%74%28%31%29%3C%2F%73%63%72%69%70%74%3E/`\n\n![image](https://github.com/user-attachments/assets/28d8e7c6-efb9-49df-b049-56dab229d74f)\n\n### Impact\n\nThe vulnerability affect end-users, allowing an attacker to craft and send a malicious link to the victim which leads running script on their browser.\n\n### Credits\n[l34k3d](https://github.com/xL34K3D)\n[ottoboni](https://github.com/gabrielott)","status":"published","published":"2025-03-06T18:52:17Z","modified":"2025-08-26T15:39:59Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:58.401149Z"}]}}