/Vulnerability Library

NocoDB < 0.258.0 - Reflected XSS in Password Reset

CVE-2025-27506
Verified

Description

NocoDB versions before 0.258.0 contain a reflected cross-site scripting caused by insecure use of '\u003C%-' in resetPassword.ts, letting attackers execute malicious scripts in victims' browsers, exploit requires sending crafted requests to /api/v1/db/auth/password/reset/:tokenId.

Severity

Medium

CVSS Score

5.4

Exploit Probability

1%

Published Date

February 24, 2026

Template Author

0x_akoko

CVE-2025-27506.yaml
5.4Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
CVE ID:
cve-2025-27506
CWE ID:
cwe-79

References

https://github.com/nocodb/nocodb/security/advisories/GHSA-wf6c-hrhf-86cwhttps://nvd.nist.gov/vuln/detail/CVE-2025-27506https://github.com/nocodb/nocodb/commit/ea821edb133e621e26183ae65c8ff9ee5d6f2723

Remediation Steps

Update to version 0.258.0 or later.