Is CVE-2025-49142 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-49142 being exploited in the wild.

How severe is CVE-2025-49142?

Medium severity, with a CVSS score of 4, published 10 June 2025.

Which products and versions are affected?

nautobot (PyPI) ECOSYSTEM:introduced=0,fixed=1.6.32, ECOSYSTEM:introduced=0,fixed=1.6.32,introduced=2.0.0,fixed=2.4.10.

Is there a fix for CVE-2025-49142?

Yes. nautobot (PyPI): upgrade to 1.6.32, 2.4.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-49142 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2025-49142?

Check whether you run jinja2 (PyPI) or nautobot (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-49142: Nautobot secrets exposure and data manipulation via Jinja2 templating

CVE-2025-49142 · Severity: medium · CVSS 4 · Published 2025-06-10

Nautobot, a popular network source of truth and automation platform, is vulnerable to a security flaw in its templating engine. A user with limited access could potentially view sensitive system secrets or modify data they are not authorized to change. This could lead to unauthorized network configuration changes or the exposure of administrative credentials.

Technologies: jinja2 (PyPI), nautobot (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2025-49142 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-49142 being exploited in the wild.
How severe is CVE-2025-49142?: Medium severity, with a CVSS score of 4, published 10 June 2025.
Which products and versions are affected?: nautobot (PyPI) ECOSYSTEM:introduced=0,fixed=1.6.32, ECOSYSTEM:introduced=0,fixed=1.6.32,introduced=2.0.0,fixed=2.4.10.
Is there a fix for CVE-2025-49142?: Yes. nautobot (PyPI): upgrade to 1.6.32, 2.4.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-49142 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2025-49142?: Check whether you run jinja2 (PyPI) or nautobot (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

nautobot (PyPI): upgrade to 1.6.32, 2.4.10 or later
```
pip install "nautobot>=2.4.10"
```

Technical details

Nautobot versions prior to 1.6.32 and 2.4.10 contain an improper neutralization of special elements in its Jinja2 templating implementation (CWE-1336). The vulnerability exists in features that utilize templating, such as computed fields, custom links, and job buttons. An attacker with low privileges can craft malicious Jinja2 templates to expose the values of defined Secrets or invoke Python APIs to modify internal data, effectively bypassing object-level permission checks. The issue stems from an insecure Jinja2 sandbox configuration. Patches are available in versions 1.6.32 and 2.4.10.

Affected products

Network to Code Nautobot < 1.6.32, >= 2.0.0, < 2.4.10

Identifiers

CVE-2025-49142
GHSA-wjw6-95h5-4jpx
PYSEC-2025-74
PYSEC-2025-79

Timeline

2025-06-10: disclosed
2025-06-10: advisory
2025-06-10: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.