CVE-2025-27506: NocoDB Password Reset XSS Vulnerability

CVE-2025-27506 Overview

CVE-2025-27506 is a Reflected Cross-Site Scripting (XSS) vulnerability in NocoDB, an open-source platform for building databases as spreadsheets. The flaw resides in the password reset API endpoint /api/v1/db/auth/password/reset/:tokenId. The resetPassword.ts template uses the EJS unescaped output tag <%-, which the renderPasswordReset function processes without sanitization. Attackers can craft a malicious tokenId value that reflects back into the rendered HTML, executing arbitrary JavaScript in the victim's browser. The issue is fixed in NocoDB version 0.258.0.

Critical Impact
Attackers can execute arbitrary JavaScript in a victim's browser session by tricking them into visiting a crafted password reset URL, enabling credential theft and session hijacking.

Affected Products

NocoDB versions prior to 0.258.0
Self-hosted NocoDB deployments exposing the password reset endpoint
NocoDB instances using the auth.controller.ts and resetPassword.ts authentication modules

Discovery Timeline

2025-03-06 - CVE-2025-27506 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-27506

Vulnerability Analysis

The vulnerability is a Reflected Cross-Site Scripting flaw [CWE-79] in the NocoDB password reset workflow. When a user visits /api/v1/db/auth/password/reset/:tokenId, the renderPasswordReset function in auth.controller.ts passes the tokenId path parameter into an EJS template. The template resetPassword.ts renders the token using the <%- tag, which outputs raw unescaped content directly into the HTML response. An attacker who supplies JavaScript payload as the tokenId triggers execution in the victim's browser context once the crafted URL is opened.

Root Cause

The root cause is the use of the EJS unescaped interpolation operator <%- instead of the escaping operator <%= when rendering user-controllable input. The tokenId value flows from the URL path directly into the template without HTML entity encoding. This allows the token to break out of the intended JavaScript variable assignment and inject arbitrary script content into the DOM.

Attack Vector

Exploitation requires user interaction. An attacker crafts a URL containing a malicious payload in the tokenId position and delivers it via phishing, chat, or a malicious link. When the victim opens the link in an authenticated browser session, the injected script runs in the origin of the NocoDB application. This enables cookie theft, session token exfiltration, forced actions on behalf of the user, and phishing overlays.

typescript

// Patch in packages/nocodb/src/modules/auth/auth.controller.ts
           (await import('~/modules/auth/ui/auth/resetPassword')).default,
           {
             ncPublicUrl: process.env.NC_PUBLIC_URL || '',
-            token: JSON.stringify(tokenId),
+            token: tokenId,
             baseUrl: `/`,
           },
         ),

typescript

// Patch in packages/nocodb/src/modules/auth/ui/auth/emailVerify.ts
       valid: null,
       errMsg: null,
       validForm: false,
-      token: <%= token %>,
+      token: '<%= token %>',
       greeting: 'Password Reset',
       formdata: {
         password: '',

Source: GitHub Commit ea821ed. The fix wraps the template variable in string quotes and switches to the HTML-escaping tag <%= so the token is treated as a string literal rather than executable code.

Detection Methods for CVE-2025-27506

Indicators of Compromise

HTTP requests to /api/v1/db/auth/password/reset/ containing angle brackets, script tags, javascript: URIs, or event handler attributes such as onerror= and onload=
URL-encoded XSS payloads (%3Cscript%3E, %22%3E) appearing in the tokenId path segment
Referer headers from external domains preceding a password reset request

Detection Strategies

Deploy Web Application Firewall (WAF) rules that inspect the tokenId path parameter for HTML metacharacters and known XSS signatures
Review NocoDB application logs for anomalous tokenId values that deviate from the expected token format (alphanumeric, fixed length)
Correlate password reset requests with subsequent authenticated session activity from unusual IPs or user agents

Monitoring Recommendations

Alert on any request to the password reset endpoint containing non-token characters such as <, >, ", ', or (
Enable browser Content Security Policy (CSP) reporting to surface inline script violations originating from the NocoDB origin
Monitor for spikes in password reset endpoint traffic that may indicate mass phishing distribution

How to Mitigate CVE-2025-27506

Immediate Actions Required

Upgrade NocoDB to version 0.258.0 or later, which contains the fix in commit ea821ed
Inventory all self-hosted NocoDB instances and validate the deployed version against the fixed release
Rotate any user session tokens and password reset tokens issued prior to patching

Patch Information

The vulnerability is fixed in NocoDB 0.258.0. The patch modifies auth.controller.ts to pass the raw tokenId and updates the EJS templates in resetPassword.ts and emailVerify.ts to use the escaping tag <%= with quoted string context. See the GitHub Security Advisory GHSA-wf6c-hrhf-86cw and the upstream commit ea821ed for the complete diff.

Workarounds

Place NocoDB behind a reverse proxy or WAF that blocks requests to /api/v1/db/auth/password/reset/ when the path parameter contains HTML special characters
Enforce a strict Content Security Policy that disallows inline scripts to reduce the impact of reflected payloads
Restrict NocoDB administrative access to trusted networks until the patch is applied

bash

# Example nginx rule blocking suspicious characters in tokenId path
location ~* ^/api/v1/db/auth/password/reset/ {
    if ($request_uri ~* "[<>\"']|script|javascript:|onerror=|onload=") {
        return 403;
    }
    proxy_pass http://nocodb_backend;
}