https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-24T01:00:05.765688+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cnvd-2025-05387 cnvd-2025-05387 2026-10-24T01:00:05.769639+00:00 cnvd-2025-05387 https://cve.radiocsirt.org/vuln/euvd-2026-221179 EUVD-2026-221179 2026-10-24T01:00:05.769672+00:00 EUVD-2026-221179 https://cve.radiocsirt.org/vuln/fkie_cve-2025-27506 fkie_cve-2025-27506 2026-10-24T01:00:05.769685+00:00

NocoDB is software for building databases as spreadsheets. The API endpoint related to the password reset function is vulnerable to Reflected Cross-Site-Scripting. The endpoint /api/v1/db/auth/password/reset/:tokenId is vulnerable to Reflected Cross-Site-Scripting. The flaw occurs due to implementation of the client-side template engine ejs, specifically on file resetPassword.ts where the template is using the insecure function “<%-“, which is rendered by the function renderPasswordReset. This vulnerability is fixed in 0.258.0.

 https://cve.radiocsirt.org/vuln/ghsa-wf6c-hrhf-86cw GHSA-wf6c-hrhf-86cw — NocoDB Vulnerable to Reflected Cross-Site Scripting on Reset Password Page 2026-10-24T01:00:05.769724+00:00

Affected: npm: nocodb

### Summary

The API endpoint related to the password reset function is vulnerable to Reflected Cross-Site-Scripting.

### Details

Throughout the source-code analysis, it has been found that the endpoint /api/v1/db/auth/password/reset/:tokenId is vulnerable to Reflected Cross-Site-Scripting. The flaw occurs due to implementation of the client-side template engine ejs, specifically on file resetPassword.ts where the template is using the insecure function “<%-“ https://github.com/nocodb/nocodb/blob/ba5a191b33259d984fc92df225f7d82ede2ddb56/packages/nocodb/src/modules/auth/ui/auth/resetPassword.ts#L71 which is rendered by the function renderPasswordReset: https://github.com/nocodb/nocodb/blob/ba5a191b33259d984fc92df225f7d82ede2ddb56/packages/nocodb/src/modules/auth/auth.controller.ts#L251

### PoC

Send the request below to a vulnerable instance: `/api/v1/db/auth/password/reset/asdsad%3C%2F%73%63%72%69%70%74%3E%3C%73%63%72%69%70%74%3E%61%6C%65%72%74%28%31%29%3C%2F%73%63%72%69%70%74%3E/`

![image](https://github.com/user-attachments/assets/28d8e7c6-efb9-49df-b049-56dab229d74f)

### Impact

The vulnerability affect end-users, allowing an attacker to craft and send a malicious link to the victim which leads running script on their browser.

### Credits [l34k3d](https://github.com/xL34K3D) [ottoboni](https://github.com/gabrielott)