Is CVE-2026-83801 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-83801 being exploited in the wild.

How severe is CVE-2026-83801?

Medium severity, with a CVSS score of 5.4, published 22 September 2026.

Which products and versions are affected?

nautobot (PyPI) ECOSYSTEM:introduced=0,fixed=2.4.37, ECOSYSTEM:introduced=0,fixed=2.4.37,introduced=3.0.0,fixed=3.1.8.

Is there a fix for CVE-2026-83801?

Yes. nautobot (PyPI): upgrade to 2.4.37, 3.1.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-83801 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-83801?

Check whether you run nautobot (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-83801: Nautobot stored cross-site scripting in form help text

CVE-2026-83801 · Severity: medium · CVSS 5.4 · Published 2026-09-22

Nautobot is a network source-of-truth application used to manage infrastructure data. A stored cross-site scripting vulnerability allows users with permission to edit Relationships or Module Families to inject malicious scripts that execute in the browsers of any user (including administrators) who open the affected forms. An attacker can use this to steal sessions, perform unauthorized actions, or escalate privileges.

Technologies: nautobot (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-83801 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-83801 being exploited in the wild.
How severe is CVE-2026-83801?: Medium severity, with a CVSS score of 5.4, published 22 September 2026.
Which products and versions are affected?: nautobot (PyPI) ECOSYSTEM:introduced=0,fixed=2.4.37, ECOSYSTEM:introduced=0,fixed=2.4.37,introduced=3.0.0,fixed=3.1.8.
Is there a fix for CVE-2026-83801?: Yes. nautobot (PyPI): upgrade to 2.4.37, 3.1.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-83801 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-83801?: Check whether you run nautobot (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

nautobot (PyPI): upgrade to 2.4.37, 3.1.8 or later
```
pip install "nautobot>=3.1.8"
```

Technical details

The vulnerability is a stored cross-site scripting (XSS) flaw in two locations within Nautobot's form rendering: (1) Relationship descriptions used as form help text, and (2) Module Family names interpolated into module field help text. Both are rendered using Django's `|safe` filter in `render_field.html`, bypassing auto-escaping. An attacker with `extras.add_relationship`, `extras.change_relationship`, `dcim.add_modulefamily`, or `dcim.change_modulefamily` permissions can inject HTML/JavaScript payloads that execute in the authenticated session of any user opening the affected create/edit forms. No user interaction beyond opening a form is required. The vulnerability affects Nautobot v2.4.36 and earlier v2.x, and v3.1.7 and earlier v3.x; patches are available in v2.4.37+ and v3.1.8+.

Affected products

Nautobot Nautobot before 2.4.37, before 3.1.8

Identifiers

CVE-2026-83801
GHSA-56v6-2fhr-wxgq
PYSEC-2026-4110

Timeline

2026-09-22: disclosed: Published as GHSA-56v6-2fhr-wxgq
2026-09-22: patched: Patches available in v2.4.37+ and v3.1.8+

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.