https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 07:47:22 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-329825 EUVD-2026-329825 https://cve.radiocsirt.org/vuln/euvd-2026-329825 https://cve.radiocsirt.org/vuln/fkie_cve-2026-47376 <p>NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, the password-reset page rendered the URL token directly into a JavaScript string literal in a server-rendered EJS template. EJS &lt;%= %&gt; HTML-entity-encodes a fixed set of characters but does not escape single quotes or backslashes, so a crafted token could break out of the JS string context and execute attacker-controlled script in the NocoDB origin. Triggering required only that a victim follow a malicious password-reset link. This vulnerability is fixed in 2026.04.1.</p> <p>NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, the password-reset page rendered the URL token directly into a JavaScript string literal in a server-rendered EJS template. EJS &lt;%= %&gt; HTML-entity-encodes a fixed set of characters but does not escape single quotes or backslashes, so a crafted token could break out of the JS string context and execute attacker-controlled script in the NocoDB origin. Triggering required only that a victim follow a malicious password-reset link. This vulnerability is fixed in 2026.04.1.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-47376 https://cve.radiocsirt.org/vuln/ghsa-6xcx-7qmg-vjfq <p><strong>Affected:</strong> npm: nocodb</p> <p>### Summary</p> <p>The password-reset page rendered the URL token directly into a JavaScript string literal in a server-rendered EJS template. EJS `&lt;%= %&gt;` HTML-entity-encodes a fixed set of characters but does not escape single quotes or backslashes, so a crafted token could break out of the JS string context and execute attacker-controlled script in the NocoDB origin. Triggering required only that a victim follow a malicious password-reset link.</p> <p>### Details</p> <p>The vulnerable template embedded the token as:</p> <p>```ejs token: &#39;&lt;%= token %&gt;&#39;, ```</p> <p>A token containing `&#39;;alert(document.cookie);//` closes the single-quoted string and runs arbitrary JavaScript. The fix moves the token into an HTML attribute (`data-token=&#34;…&#34;`) and reads it from `dataset.token` at runtime, so EJS&#39;s HTML-entity escaping is sufficient.</p> <p>### Impact</p> <p>- Reflected XSS in the NocoDB origin via a phished password-reset URL. - No authentication required to trigger; affects any user who clicks the crafted link. - Same-origin script can read auth state and act on the victim&#39;s behalf.</p> <p>### Credit</p> <p>This issue was reported by [@fg0x0](https://github.com/fg0x0).</p> <p><strong>Affected:</strong> npm: nocodb</p> <p>### Summary</p> <p>The password-reset page rendered the URL token directly into a JavaScript string literal in a server-rendered EJS template. EJS `&lt;%= %&gt;` HTML-entity-encodes a fixed set of characters but does not escape single quotes or backslashes, so a crafted token could break out of the JS string context and execute attacker-controlled script in the NocoDB origin. Triggering required only that a victim follow a malicious password-reset link.</p> <p>### Details</p> <p>The vulnerable template embedded the token as:</p> <p>```ejs token: &#39;&lt;%= token %&gt;&#39;, ```</p> <p>A token containing `&#39;;alert(document.cookie);//` closes the single-quoted string and runs arbitrary JavaScript. The fix moves the token into an HTML attribute (`data-token=&#34;…&#34;`) and reads it from `dataset.token` at runtime, so EJS&#39;s HTML-entity escaping is sufficient.</p> <p>### Impact</p> <p>- Reflected XSS in the NocoDB origin via a phished password-reset URL. - No authentication required to trigger; affects any user who clicks the crafted link. - Same-origin script can read auth state and act on the victim&#39;s behalf.</p> <p>### Credit</p> <p>This issue was reported by [@fg0x0](https://github.com/fg0x0).</p> https://cve.radiocsirt.org/vuln/ghsa-6xcx-7qmg-vjfq