CVE-2026-47376: NocoDB: Reflected Cross-Site Scripting via Password Reset Token

June 5, 2026 (updated July 20, 2026)

The password-reset page rendered the URL token directly into a JavaScript string literal in a server-rendered EJS template. EJS <%= %> HTML-entity-encodes a fixed set of characters but does not escape single quotes or backslashes, so a crafted token could break out of the JS string context and execute attacker-controlled script in the NocoDB origin. Triggering required only that a victim follow a malicious password-reset link.

References

github.com/advisories/GHSA-6xcx-7qmg-vjfq
github.com/nocodb/nocodb/releases/tag/2026.04.1
github.com/nocodb/nocodb/security/advisories/GHSA-6xcx-7qmg-vjfq
nvd.nist.gov/vuln/detail/CVE-2026-47376

Code Behaviors & Features

Detect and mitigate CVE-2026-47376 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →