Executive brief
Nautobot is a network source-of-truth application used to manage infrastructure data. A stored cross-site scripting vulnerability allows users with permission to edit Relationships or Module Families to inject malicious scripts that execute in the browsers of any user (including administrators) who open the affected forms. An attacker can use this to steal sessions, perform unauthorized actions, or escalate privileges.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in two locations within Nautobot's form rendering: (1) Relationship descriptions used as form help text, and (2) Module Family names interpolated into module field help text. Both are rendered using Django's `|safe` filter in `render_field.html`, bypassing auto-escaping. An attacker with `extras.add_relationship`, `extras.change_relationship`, `dcim.add_modulefamily`, or `dcim.change_modulefamily` permissions can inject HTML/JavaScript payloads that execute in the authenticated session of any user opening the affected create/edit forms. No user interaction beyond opening a form is required. The vulnerability affects Nautobot v2.4.36 and earlier v2.x, and v3.1.7 and earlier v3.x; patches are available in v2.4.37+ and v3.1.8+.
Affected products
- Nautobot Nautobot before 2.4.37, before 3.1.8
Timeline
- 2026-09-22: disclosed: Published as GHSA-56v6-2fhr-wxgq
- 2026-09-22: patched: Patches available in v2.4.37+ and v3.1.8+