Alta

XSS potential in rendered Markdown fields (comments, description, notes, etc.)

Publicada: 23.01.2024
Actualizado: 11.10.2026 15:17

Impact

All users of Nautobot versions earlier than 1.6.10 or 2.1.2 are potentially impacted.

Due to inadequate input sanitization, any user-editable fields that support Markdown rendering, including:

Circuit.comments
Cluster.comments
CustomField.description
Device.comments
DeviceRedundancyGroup.comments
DeviceType.comments
Job.description
JobLogEntry.message
Location.comments
Note.note
PowerFeed.comments
Provider.noc_contact
Provider.admin_contact
Provider.comments
ProviderNetwork.comments
Rack.comments
Tenant.comments
VirtualMachine.comments
Contents of any custom fields of type markdown
Job class description attributes
The SUPPORT_MESSAGE system configuration setting

are potentially susceptible to cross-site scripting (XSS) attacks via maliciously crafted data.

Patches

Fixed in Nautobot versions 1.6.10 and 2.1.2.

References

https://github.com/nautobot/nautobot/pull/5133 https://github.com/nautobot/nautobot/pull/5134

Software afectado

Haz clic en una tecnología para ver todas sus vulnerabilidades.

Plataforma	Paquete	Versiones vulnerables	Corregida en
Python (PyPI)	nautobot	>= 2.0.0, < 2.1.2, < 1.6.10	2.1.2, 1.6.10

Referencias

Puntuación CVSS 7.1/10

Vector CVSS: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:L
Debilidad (CWE): CWE-79
Plataforma: Python (PyPI)
Paquete: nautobot
Publicada: 23.01.2024
Actualizado: 11.10.2026 15:17

Fuentes y licencias

OSV / GitHub Advisory Database - PYSEC-2024-16 - PyPA Advisory Database; CC BY 4.0

OSV / GitHub Advisory Database - GHSA-v4xv-795h-rv4h - CC BY 4.0

Historial de vulnerabilidades: nautobot

Todas las vulnerabilidades publicadas de este paquete (Python (PyPI)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.

Todas (19) en el archivo

Entradas en total: 19
Primera → última: 02.2023 09.2026
Sin corrección: 0
Explotada en ataques: 0

Distribución por gravedad

Alta 9
Media 6
Baja 4

Divulgaciones por año

2023: 5
2024: 5
2025: 2
2026: 7

13.05.2026

Nautobot: GitRepository.current_head field should not be writable through REST API

Alta · 7.1 CVE-2026-44798 >= 3.0.0a2, < 3.1.2, < 2.4.33 3.1.2, 2.4.33
13.05.2026

Nautobot: Webhook definitions could be used for server-side request forgery (SSRF)

Alta · 8.5 CVE-2026-44797 >= 3.0.0a2, < 3.1.2, < 2.4.33 3.1.2, 2.4.33
10.06.2025

Nautobot is a Network Source of Truth and Network Automation Platform. All users of Nautobot versions prior to 2.4.10 or prior to 1.6.32 are potentially affected. Due to insufficient security configur

Alta · 7.1 CVE-2025-49142 < 1.6.32, >= 2.0.0, < 2.4.10 1.6.32, 2.4.10
13.05.2024

Nautobot's BANNER_* configuration can be used to inject arbitrary HTML content into Nautobot pages

Alta · 7.5 CVE-2024-34707 < 1.6.22, >= 2.0.0, < 2.2.4 1.6.22, 2.2.4
01.05.2024

nautobot has reflected Cross-site Scripting potential in all object list views

Alta · 7.5 CVE-2024-32979 >= 1.5.0, < 1.6.20, >= 2.0.0, < 2.2.3 1.6.20, 2.2.3
23.01.2024

XSS potential in rendered Markdown fields (comments, description, notes, etc.) esta entrada

Alta · 7.1 CVE-2024-23345 >= 2.0.0, < 2.1.2, < 1.6.10 2.1.2, 1.6.10
22.11.2023

Cross-site Scripting potential in custom links, job buttons, and computed fields

Alta · 7.1 CVE-2023-48705 < 1.6.6, >= 2.0.0, < 2.0.5 1.6.6, 2.0.5
24.10.2023

Nautobot vulnerable to exposure of hashed user passwords via REST API

Alta · 7.7 CVE-2023-46128 >= 2.0.0, < 2.0.3 2.0.3
21.02.2023

Nautobot vulnerable to remote code execution via Jinja2 template rendering

Alta · 7.5 CVE-2023-25657 < 1.5.7 1.5.7

Identifica las vulnerabilidades de tu aplicación

Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.

Conectar tu aplicación