CVE-2026-47376 Overview
CVE-2026-47376 is a reflected Cross-Site Scripting (XSS) vulnerability in NocoDB, an open-source platform that turns relational databases into spreadsheet-style applications. The flaw exists in the password-reset page, which renders the URL token directly into a JavaScript string literal inside a server-rendered EJS template. EJS <%= %> interpolation HTML-entity-encodes a limited character set but does not escape single quotes or backslashes. Attackers can craft a token that breaks out of the JavaScript string context and executes arbitrary script in the NocoDB origin. Exploitation requires a victim to click a malicious password-reset link. The issue is tracked as [CWE-79] and is fixed in NocoDB version 2026.04.1.
Critical Impact
A crafted password-reset link can execute attacker-controlled JavaScript in the NocoDB origin, enabling session theft, account takeover, and unauthorized actions against the target instance.
Affected Products
- NocoDB versions prior to 2026.04.1
- Self-hosted NocoDB deployments exposing the password-reset endpoint
- Any NocoDB instance using the vulnerable EJS-rendered reset template
Discovery Timeline
- 2026-06-23 - CVE-2026-47376 published to the National Vulnerability Database
- 2026-06-25 - Last updated in NVD database
Technical Details for CVE-2026-47376
Vulnerability Analysis
The vulnerability resides in NocoDB's password-reset page. The server takes the token supplied in the reset URL and embeds it into a JavaScript string literal within an EJS template. EJS's default <%= %> interpolation escapes only a small set of HTML-relevant characters such as <, >, &, and double quotes. It does not escape single quotes or backslashes, both of which are syntactically significant inside JavaScript string literals.
When the token contains a single quote or backslash, the attacker terminates the surrounding string literal and injects executable JavaScript. The injected payload runs in the NocoDB origin with the privileges of any user who follows the link. This enables session cookie theft, CSRF-style state changes, exfiltration of database content viewed in the browser, and full account takeover when chained with reset-flow abuse.
Root Cause
The root cause is context-mismatched output encoding. HTML entity encoding is insufficient when untrusted data is interpolated into a JavaScript execution context. The reset template should have applied JavaScript-string escaping, performed the assignment client-side from a safely encoded data attribute, or validated that the token matched a strict alphanumeric grammar before rendering.
Attack Vector
The attack is network-based and requires user interaction. An attacker crafts a password-reset URL containing a malicious token payload such as a closing single quote, arbitrary script, and a trailing comment. The victim clicks the link, the server renders the EJS template, and the resulting page executes the attacker's JavaScript in the NocoDB origin. No authentication is required from the attacker, but the victim must visit the link in an authenticated or unauthenticated browser session targeting the NocoDB host.
No public exploit code has been observed at the time of publication. Technical details are available in the NocoDB GitHub Security Advisory.
Detection Methods for CVE-2026-47376
Indicators of Compromise
- Inbound HTTP requests to the password-reset endpoint with tokens containing single quotes, backslashes, <script, or URL-encoded equivalents (%27, %5C).
- Reset URLs with token lengths or character sets that deviate from the application's normal token format.
- Outbound browser requests from the NocoDB origin to attacker-controlled domains following a reset-link click.
- Reverse-proxy or WAF logs showing reset requests with JavaScript keywords such as alert, fetch, or document.cookie in query parameters.
Detection Strategies
- Inspect access logs for password-reset paths and flag tokens that fail a strict alphanumeric or hex regular expression.
- Deploy a web application firewall rule that blocks reset tokens containing JavaScript metacharacters.
- Correlate reset-link clicks with subsequent authenticated actions to identify session hijack patterns.
- Monitor email and messaging gateways for inbound links pointing at internal NocoDB hosts with anomalous query strings.
Monitoring Recommendations
- Enable verbose logging on the NocoDB authentication subsystem and centralize logs for correlation.
- Alert on Content Security Policy violation reports from the NocoDB origin, which can surface injected script execution.
- Track new outbound network destinations from browsers visiting NocoDB to identify exfiltration attempts.
How to Mitigate CVE-2026-47376
Immediate Actions Required
- Upgrade all NocoDB instances to version 2026.04.1 or later.
- Invalidate outstanding password-reset tokens and force re-issuance after upgrade.
- Rotate session secrets and require re-authentication for active users.
- Review audit logs for suspicious reset-link clicks since the vulnerability's introduction.
Patch Information
NocoDB version 2026.04.1 removes the unsafe interpolation in the password-reset template. Refer to the GitHub Security Advisory GHSA-6xcx-7qmg-vjfq for the upstream fix details and release notes.
Workarounds
- Place NocoDB behind a reverse proxy or WAF that rejects reset tokens not matching a strict character set such as ^[A-Za-z0-9_-]{20,}$.
- Restrict access to the password-reset endpoint to trusted networks where feasible.
- Apply a strict Content Security Policy that disallows inline script execution on the NocoDB origin to reduce exploitability until the patch is deployed.
- Educate users to avoid clicking password-reset links they did not request.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
