The vulnerability resides in the password‑reset page of NocoDB, where a token from the URL is directly inserted into a JavaScript string literal within an EJS template. Because EJS's <%= %> encoders only escape a limited set of characters and do not escape single quotes or backslashes, an attacker can craft a token that terminates the string and injects malicious script executed in the victim’s browser under the NocoDB domain. This is a reflected cross‑site scripting flaw (CWE‑79) that can lead to session hijacking, data theft, or unauthorized actions, and is fixed in version 2026.04.1.

Affected vendor NocoDB. The product is NocoDB, any installation running a version older than 2026.04.1 is susceptible. The flaw is located in the password‑reset mechanism before that release.

The CVSS score of 5.1 indicates moderate severity. Exploitation requires only that a target user click a malicious password‑reset link. No elevation of privileges is required, but the impact is fully within the originating domain, enabling data theft or manipulation. EPSS is not available and the vulnerability is not listed in CISA KEV, suggesting no publicly exploited variants yet. Nonetheless, because the attack vector is simple, the vulnerability should be remediated with priority.