CVE-2026-47376— NocoDB: Reflected Cross-Site Scripting via Password Reset Token
Quick assessment
Affected
nocodb nocodb
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
NocoDB是nocodb公司开源的一个 Airtable 替代品。将任何 MySql、PostgreSql、Sql Server、Sqlite 和 MariaDb 转换为智能电子表格。 NocoDB 2026.04.1之前版本存在跨站脚本漏洞，该漏洞源于密码重置页面将URL令牌直接渲染到服务器渲染的EJS模板中的JavaScript字符串文字中，可能导致受害者点击恶意密码重置链接时执行攻击者控制的脚本。
Possible ATT&CK Techniques 1 AI
T1189 · Drive-by Compromise
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-47376
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
NocoDB: Reflected Cross-Site Scripting via Password Reset Token
Source: CVE Program / CVE List V5
Vulnerability Description
NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, the password-reset page rendered the URL token directly into a JavaScript string literal in a server-rendered EJS template. EJS <%= %> HTML-entity-encodes a fixed set of characters but does not escape single quotes or backslashes, so a crafted token could break out of the JS string context and execute attacker-controlled script in the NocoDB origin. Triggering required only that a victim follow a malicious password-reset link. This vulnerability is fixed in 2026.04.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Vulnerability Title
NocoDB 跨站脚本漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
NocoDB是nocodb公司开源的一个 Airtable 替代品。将任何 MySql、PostgreSql、Sql Server、Sqlite 和 MariaDb 转换为智能电子表格。 NocoDB 2026.04.1之前版本存在跨站脚本漏洞，该漏洞源于密码重置页面将URL令牌直接渲染到服务器渲染的EJS模板中的JavaScript字符串文字中，可能导致受害者点击恶意密码重置链接时执行攻击者控制的脚本。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-47376
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-47376
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-47376 (1)
Same Patch Batch · nocodb · 2026-06-23 · 29 CVEs total
| CVE-2026-46551 | 6.5 MEDIUM | NocoDB: Missing File Size Enforcement in Upload-by-URL Allows Denial of Service via Disk E |
| CVE-2026-46547 | 6.1 MEDIUM | NocoDB: Reflected Cross-Site Scripting via Page Leaving Redirect URL |
| CVE-2026-47375 | 6.0 MEDIUM | NocoDB: Postgres SQL Injection in Formula `ARRAYSORT` |
| CVE-2026-46552 | 5.8 MEDIUM | NocoDB: Shared-base link access can invite arbitrary users as persistent base members |
| CVE-2026-46550 | 5.4 MEDIUM | NocoDB: Refresh Token Cookie Set Without `Secure` and `SameSite` Flags |
| CVE-2026-46548 | 4.3 MEDIUM | NocoDB: SSRF Protection Bypass in Notification Webhook Plugins (Slack, Discord, Mattermost |
| CVE-2026-46549 | 2.0 LOW | NocoDB: OAuth Token Scope Not Enforced at ACL Layer Allows Scope Escalation |
| CVE-2026-47377 | NocoDB: Open Redirect via Hash Fragment in hashRedirect Plugin | |
| CVE-2026-46553 | NocoDB: Attachment Size Limit Bypass via Upload-by-URL | |
| CVE-2026-46554 | NocoDB: Stale Auth Cache After API Token Deletion | |
| CVE-2026-47385 | NocoDB: Path Traversal via SQLite Source Filename | |
| CVE-2026-47382 | NocoDB: Server-Side Request Forgery via Database Connection Host | |
| CVE-2026-47384 | NocoDB: SQL Injection via Column Title in Bulk GroupBy | |
| CVE-2026-47386 | NocoDB: OAuth Authorization Code Race Condition | |
| CVE-2026-53929 | NocoDB: Stored Cross-Site Scripting via Secure Attachment | |
| CVE-2026-47381 | NocoDB: Cross-Workspace Integration Use in Connection Test | |
| CVE-2026-47378 | NocoDB: Hidden Column Exposure in Public Shared View Endpoints | |
| CVE-2026-47379 | NocoDB: Plaintext Password Comparison in Shared Views | |
| CVE-2026-47388 | NocoDB: Missing Ownership Check in MCP Attachment Read | |
| CVE-2026-47387 | NocoDB: Stored Cross-Site Scripting via Form View Redirect URL |
Showing top 20 of 29 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: nocodb
-
CVE-2026-46547
NocoDB: Reflected Cross-Site Scripting via Page Leaving Redi -
CVE-2026-46548
NocoDB: SSRF Protection Bypass in Notification Webhook Plugi -
CVE-2026-46549
NocoDB: OAuth Token Scope Not Enforced at ACL Layer Allows S -
CVE-2026-46550
NocoDB: Refresh Token Cookie Set Without `Secure` and `SameS -
CVE-2026-46552
NocoDB: Shared-base link access can invite arbitrary users a
Same vendor: nocodb
-
CVE-2026-46547
NocoDB: Reflected Cross-Site Scripting via Page Leaving Redi -
CVE-2026-46548
NocoDB: SSRF Protection Bypass in Notification Webhook Plugi -
CVE-2026-46549
NocoDB: OAuth Token Scope Not Enforced at ACL Layer Allows S -
CVE-2026-46550
NocoDB: Refresh Token Cookie Set Without `Secure` and `SameS -
CVE-2026-46552
NocoDB: Shared-base link access can invite arbitrary users a
Same weakness: CWE-79
-
CVE-2026-66610
WordPress Urna theme <= 2.6.2 - Cross Site Scripting (XSS) v -
CVE-2026-32476
WordPress Brave Conversion Engine (PRO) plugin <= 0.8.6 - Cr -
CVE-2026-28166
WordPress Tourmaster plugin <= 5.4.9 - Cross Site Scripting -
CVE-2026-28162
WordPress Events Made Easy plugin <= 3.2.5 - Cross Site Scri -
CVE-2026-78290
WordPress Magazine Blocks plugin <= 1.8.6 - Cross Site Scrip
V. Comments for CVE-2026-47376
No comments yet