Tóm tắt nhanh
- CVE-2026-47376 là lỗ hổng mức TRUNG BÌNH (CVSS 5.1) ảnh hưởng nocodb.
- Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.44%, cao hơn 38.6% các lỗ hổng khác.
- Cách xử lý: cập nhật lên 2026.04.1 hoặc mới hơn.
| Gói / sản phẩm | Phiên bản bị ảnh hưởng | Phiên bản đã vá |
|---|
| nocodb npm | < 2026.04.1
| 2026.04.1
|
Mô tả
Summary
The password-reset page rendered the URL token directly into a JavaScript string literal in a server-rendered EJS template. EJS <%= %> HTML-entity-encodes a fixed set of characters but does not escape single quotes or backslashes, so a crafted token could break out of the JS string context and execute attacker-controlled script in the NocoDB origin. Triggering required only that a victim follow a malicious password-reset link.
Details
The vulnerable template embedded the token as:
token: '<%= token %>',
A token containing ';alert(document.cookie);// closes the single-quoted string and runs arbitrary JavaScript. The fix moves the token into an HTML attribute (data-token="…") and reads it from dataset.token at runtime, so EJS's HTML-entity escaping is sufficient.
Impact
- Reflected XSS in the NocoDB origin via a phished password-reset URL.
- No authentication required to trigger; affects any user who clicks the crafted link.
- Same-origin script can read auth state and act on the victim's behalf.
Credit
This issue was reported by @fg0x0.
Mô tả của NVD
NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, the password-reset page rendered the URL token directly into a JavaScript string literal in a server-rendered EJS template. EJS <%= %> HTML-entity-encodes a fixed set of characters but does not escape single quotes or backslashes, so a crafted token could break out of the JS string context and execute attacker-controlled script in the NocoDB origin. Triggering required only that a victim follow a malicious password-reset link. This vulnerability is fixed in 2026.04.1.
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí