Executive brief
Nautobot's BANNER_* configuration can be used to inject arbitrary HTML content into Nautobot pages
Affected products
- PyPI nautobot
Junglewise Threat Intelligence
CVE-2024-34707: PYSEC-2026-1688 - Nautobot's BANNER_* configuration can be used to inject arbitrary HTML content into Nautobot pages
CVE-2024-34707 · Severity: low · CVSS 3.1 · Published 2026-07-07
Technologies: nautobot (PyPI). Vendors: PyPI.
Related threats
- Nautobot is a Network Source of Truth and Network Automation Platform. From 3.0.0 until 3.1.8, the generic ApprovalWorkflowStageResponse cre
- PYSEC-2026-1689 - Nautobot may allows uploaded media files to be accessible without authentication
- PYSEC-2026-1686 - nautobot has reflected Cross-site Scripting potential in all object list views
- PYSEC-2026-1687 - Unauthenticated views may expose information to anonymous users
- Nautobot unauthorized data modification in GitRepository API