CVE-2025-27506: NocoDB Vulnerable to Reflected Cross-Site Scripting on Reset Password Page
Summary
The API endpoint related to the password reset function is vulnerable to Reflected Cross-Site-Scripting.
Details
Throughout the source-code analysis, it has been found that the endpoint /api/v1/db/auth/password/reset/:tokenId is vulnerable to Reflected Cross-Site-Scripting. The flaw occurs due to implementation of the client-side template engine ejs, specifically on file resetPassword.ts where the template is using the insecure function “<%-“ https://github.com/nocodb/nocodb/blob/ba5a191b33259d984fc92df225f7d82ede2ddb56/packages/nocodb/src/modules/auth/ui/auth/resetPassword.ts#L71 which is rendered by the function renderPasswordReset: https://github.com/nocodb/nocodb/blob/ba5a191b33259d984fc92df225f7d82ede2ddb56/packages/nocodb/src/modules/auth/auth.controller.ts#L251
PoC
Send the request below to a vulnerable instance: /api/v1/db/auth/password/reset/asdsad%3C%2F%73%63%72%69%70%74%3E%3C%73%63%72%69%70%74%3E%61%6C%65%72%74%28%31%29%3C%2F%73%63%72%69%70%74%3E/
!image
Impact
The vulnerability affect end-users, allowing an attacker to craft and send a malicious link to the victim which leads running script on their browser.
Credits l34k3d ottoboni
Other sources
NocoDB is software for building databases as spreadsheets. The API endpoint related to the password reset function is vulnerable to Reflected Cross-Site-Scripting. The endpoint /api/v1/db/auth/password/reset/:tokenId is vulnerable to Reflected Cross-Site-Scripting. The flaw occurs due to implementation of the client-side template engine ejs, specifically on file resetPassword.ts where the template is using the insecure function “<%-“, which is rendered by the function renderPasswordReset. This vulnerability is fixed in 0.258.0.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/nocodbto a version that resolves this vulnerability.Fixed in 0.258.0 - Upgrade
Upgrade
nocodbto a version that resolves this vulnerability.Fixed in 0.258.0
Event History
Frequently Asked Questions
What is the severity of CVE-2025-27506?
CVE-2025-27506 is classified as a high-severity vulnerability due to its potential for reflected Cross-Site Scripting exploits.
How do I fix CVE-2025-27506?
To fix CVE-2025-27506, upgrade NocoDB to version 0.258.0 or higher, where the vulnerability has been addressed.
What does CVE-2025-27506 affect?
CVE-2025-27506 affects NocoDB versions prior to 0.258.0 that utilize the password reset API endpoint.
What type of vulnerability is CVE-2025-27506?
CVE-2025-27506 is a reflected Cross-Site Scripting (XSS) vulnerability.
What impact does CVE-2025-27506 have on users?
CVE-2025-27506 can allow attackers to execute arbitrary scripts in the context of the victim's browser session.