CVE-2025-27506

NocoDB is software for building databases as spreadsheets. The API endpoint related to the password reset function is vulnerable to Reflected Cross-Site-Scripting. The endpoint /api/v1/db/auth/password/reset/:tokenId is vulnerable to Reflected Cross-Site-Scripting. The flaw occurs due to implementation of the client-side template engine ejs, specifically on file resetPassword.ts where the template is using the insecure function “<%-“, which is rendered by the function renderPasswordReset. This vulnerability is fixed in 0.258.0.

• CWE-79

• https://github.com/nocodb/nocodb/blob/ba5a191b33259d984fc92df225f7d82ede2ddb56/packages/nocodb/src/modules/auth/auth.controller.ts#L251Product
• https://github.com/nocodb/nocodb/blob/ba5a191b33259d984fc92df225f7d82ede2ddb56/packages/nocodb/src/modules/auth/ui/auth/resetPassword.ts#L71Product
• https://github.com/nocodb/nocodb/commit/ea821edb133e621e26183ae65c8ff9ee5d6f2723Patch
• https://github.com/nocodb/nocodb/security/advisories/GHSA-wf6c-hrhf-86cwExploit, Vendor Advisory

Published

Mar 6, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-27498aes-gcm is a pure Rust implementation of the AES-GCM. In dec…5.6
• CVE-2025-27499WeGIA is an open source Web Manager for Institutions with a …6.1
• CVE-2025-2750A vulnerability, which was classified as critical, was found…8.8
• CVE-2025-27500OpenZiti is a free and open source project focused on bringi…6.1
• CVE-2025-27501OpenZiti is a free and open source project focused on bringi…8.6
• CVE-2025-27505GeoServer is an open source server that allows users to shar…5.3
• CVE-2025-27507The open-source identity infrastructure software Zitadel all…9
• CVE-2025-27508Emissary is a P2P based data-driven workflow engine. The Che…7.5
• CVE-2025-27509fleetdm/fleet is an open source device management, built on …9.3
• CVE-2025-2751A vulnerability has been found in Open Asset Import Library …8.8
• CVE-2025-27510conda-forge-metadata provides programatic access to conda-fo…9.3
• CVE-2025-27511GeoServer is an open source server that allows users to shar…7.2