# CVE-2026-83801: Nautobot stored cross-site scripting in form help text

Source: https://junglewise.ai/threats/cve-2026-83801-nautobot-stored-cross-site-scripting-in-form-help-text  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-22. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-83801 · Severity: medium · CVSS 5.4 · Published 2026-09-22

Nautobot is a network source-of-truth application used to manage infrastructure data. A stored cross-site scripting vulnerability allows users with permission to edit Relationships or Module Families to inject malicious scripts that execute in the browsers of any user (including administrators) who open the affected forms. An attacker can use this to steal sessions, perform unauthorized actions, or escalate privileges.

Technologies: [nautobot (PyPI)](https://junglewise.ai/threats/technologies/nautobot). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-83801 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-83801 being exploited in the wild.

**How severe is CVE-2026-83801?** Medium severity, with a CVSS score of 5.4, published 22 September 2026.

**Which products and versions are affected?** nautobot (PyPI) ECOSYSTEM:introduced=0,fixed=2.4.37, ECOSYSTEM:introduced=0,fixed=2.4.37,introduced=3.0.0,fixed=3.1.8.

**Is there a fix for CVE-2026-83801?** Yes. nautobot (PyPI): upgrade to 2.4.37, 3.1.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-83801 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-83801?** Check whether you run nautobot (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- nautobot (PyPI): upgrade to 2.4.37, 3.1.8 or later

  ```sh
  pip install "nautobot>=3.1.8"
  ```


## Technical details

The vulnerability is a stored cross-site scripting (XSS) flaw in two locations within Nautobot's form rendering: (1) Relationship descriptions used as form help text, and (2) Module Family names interpolated into module field help text. Both are rendered using Django's `|safe` filter in `render_field.html`, bypassing auto-escaping. An attacker with `extras.add_relationship`, `extras.change_relationship`, `dcim.add_modulefamily`, or `dcim.change_modulefamily` permissions can inject HTML/JavaScript payloads that execute in the authenticated session of any user opening the affected create/edit forms. No user interaction beyond opening a form is required. The vulnerability affects Nautobot v2.4.36 and earlier v2.x, and v3.1.7 and earlier v3.x; patches are available in v2.4.37+ and v3.1.8+.

## Affected products

- Nautobot Nautobot before 2.4.37, before 3.1.8

## Identifiers

- CVE-2026-83801
- GHSA-56v6-2fhr-wxgq
- PYSEC-2026-4110

## Timeline

- 2026-09-22: disclosed: Published as GHSA-56v6-2fhr-wxgq
- 2026-09-22: patched: Patches available in v2.4.37+ and v3.1.8+

## Related threats

- [Nautobot authorization bypass in approval workflow REST API](https://junglewise.ai/threats/cve-2026-83805-nautobot-authorization-bypass-in-approval-workflow-rest-api)
- [PYSEC-2026-1689 - Nautobot may allows uploaded media files to be accessible without authentication](https://junglewise.ai/threats/cve-2025-49143-nautobot-may-allows-uploaded-media-files-to-be-accessible-without)
- [PYSEC-2026-1688 - Nautobot's BANNER_* configuration can be used to inject arbitrary HTML content into Nautobot pages](https://junglewise.ai/threats/cve-2024-34707-nautobot-s-banner-configuration-can-be-used-to-inject-arbitrary)
- [PYSEC-2026-1686 - nautobot has reflected Cross-site Scripting potential in all object list views](https://junglewise.ai/threats/cve-2024-32979-nautobot-has-reflected-cross-site-scripting-potential-in-all)
- [PYSEC-2026-1687 - Unauthenticated views may expose information to anonymous users](https://junglewise.ai/threats/cve-2024-29199-unauthenticated-views-may-expose-information-to-anonymous-users)