CVE-2025-27506 NocoDB Vulnerable to Reflected Cross-Site Scripting on Reset Password Page
Attackers can execute arbitrary scripts in victims' browsers via the password reset page, potentially leading to account takeover.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-27506?
CVE-2025-27506 is a medium-severity cross-site scripting vulnerability in nocodb, published on 6 Mar 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
NocoDB is software for building databases as spreadsheets. The API endpoint related to the password reset function is vulnerable to Reflected Cross-Site-Scripting. The endpoint /api/v1/db/auth/password/reset/:tokenId is vulnerable to Reflected Cross-Site-Scripting. The flaw occurs due to implementation of the client-side template engine ejs, specifically on file resetPassword.ts where the template is using the insecure function “<%-“, which is rendered by the function renderPasswordReset. This vulnerability is fixed in 0.258.0.
Weakness: CWE-79
Which versions are affected by CVE-2025-27506?
2 open source packages ship an affected version, including nocodb. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
nocodb npm | All versions | 0.258.0 |
nocodb npm | All versions | 0.258.0 |
Products include Nocodb Nocodb.
How do I fix CVE-2025-27506?
Upgrade nocodb to 0.258.0 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2025-27506 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-27506 exists.
Public exploit code: 1 Nuclei template.
Other vulnerabilities in nocodb
- CVE-2022-2339 Server-Side Request Forgery (SSRF) in nocodb/nocodb
- CVE-2022-2062 Generation of Error Message Containing Sensitive Information in nocodb/nocodb
- CVE-2022-2064 Insufficient Session Expiration in nocodb/nocodb
- CVE-2022-2063 Improper Privilege Management in nocodb/nocodb
- CVE-2022-2022 Cross-site Scripting (XSS) - Stored in nocodb/nocodb
Sources
Also known as GHSA-wf6c-hrhf-86cw.