CVE-2026-47376: NocoDB Reflected Cross-Site Scripting via Password Reset Token
Summary
CVE-2026-47376: NocoDB: Reflected Cross-Site Scripting via Password Reset Token. Affects nocodb versions < 2026.04.1. Fixed in 2026.04.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
NocoDB is an open-source platform that transforms databases into smart APIs and spreadsheets. It allows users to create applications without extensive coding knowledge. However, it has a vulnerability that can be exploited through its password-reset functionality, which could lead to security breaches if not addressed.
Vulnerability Detail
The vulnerability arises from the password-reset page rendering the URL token directly into a JavaScript string literal within a server-rendered EJS template. The EJS templating engine does not escape single quotes or backslashes, allowing a crafted token to break out of the JavaScript string context. This could lead to the execution of attacker-controlled scripts in the NocoDB origin. The impact includes reflected cross-site scripting (XSS) that can be triggered by any user who clicks a malicious password-reset link, potentially allowing attackers to read authentication states and act on behalf of victims.
How To Fix
Latest published version: 0.301.3 as of 22 Oct 2026
npm install nocodb@0.301.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2026.04.1
This is the first release that contains the fix.
npm install nocodb@2026.04.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid clicking on password-reset links from untrusted sources. Educate users to verify the authenticity of such links before following them.
Conclusion
The vulnerability identified as CVE-2026-47376 in NocoDB poses a significant risk through reflected XSS via the password-reset token. It is crucial to update to the patched version to safeguard against potential attacks. Users should remain vigilant about the links they click, especially those related to password resets.
See every vulnerability recorded for nocodb →
FAQ
Reflected XSS is a type of security vulnerability where an attacker can inject malicious scripts into a web page, which are then executed in the user's browser when they click on a crafted link.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can also use the Vulert playground to test your application without any signup.
If exploited, this vulnerability can allow attackers to execute scripts in the context of the victim's session, potentially leading to unauthorized access to sensitive information.
Yes, educating users about the risks of clicking on untrusted links can help mitigate the risk until the patch is applied.
The CVSS score of this vulnerability is 5.1, indicating a moderate level of risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for nocodb.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
