CVE-2026-83801 in Nautobot
Summary
by MITRE • 09/22/2026
Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.37 and 3.1.8, a user with extras.add_relationship or extras.change_relationship permission can store HTML or JavaScript in a Relationship description, and a user with dcim.add_modulefamily or dcim.change_modulefamily permission can store it in a Module Family name. Nautobot assigns these values to form field help_text rendered by render_field.html through Django's |safe filter without adequate neutralization. The stored content executes in the authenticated browser session of any user, including an administrator or superuser, who opens an affected create or edit form. This can enable actions as the victim, session or token theft, and further privilege escalation. This issue is fixed in versions 2.4.37 and 3.1.8.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/22/2026
Nautobot serves as a critical Network Source of Truth and automation platform, managing complex network infrastructure data through structured forms and relationships. A significant security vulnerability was identified within the application prior to version 2.4.37 for the stable branch and version 3.1.8 for the development branch. This flaw stems from an improper neutralization of user-controllable input before it is placed into a web page, specifically classified under CWE-79: Improper Neutralization of Input During Web Page Generation known as Cross-Site Scripting or XSS. The vulnerability affects two distinct areas of the application where specific permissions are required to trigger the exploit. Users possessing extras.add_relationship or extras.change_relationship privileges can inject malicious HTML or JavaScript into a Relationship description field. Similarly, users with dcim.add_modulefamily or dcim.change_modulefamily permissions can store such content within a Module Family name field. These fields are intended for descriptive metadata but lack sufficient sanitization mechanisms to strip out executable script tags before rendering.
The technical root cause lies in how Nautobot processes and renders these specific form fields using the Django template engine. The application utilizes the render_field.html template fragment, which applies Django's safe filter to the input values stored in the database. This filter explicitly tells Django not to escape HTML entities, thereby allowing raw HTML and JavaScript code to be interpreted by the browser as executable content rather than plain text. When an authenticated user with elevated privileges creates or edits a record containing these injected payloads, the malicious script is persisted in the backend storage without validation. The danger escalates when any other user, including administrators or superusers who possess higher levels of trust and access rights within the platform, opens the affected create or edit form to view or modify the data. Upon loading this form, the browser executes the stored JavaScript code within the context of the victim's active session.
The operational impact of this vulnerability is severe due to its ability to target high-privilege accounts through a social engineering vector disguised as routine administrative tasks. Because the script executes in the authenticated browser session of the viewer, an attacker can perform actions on behalf of that user without their knowledge or consent. This capability facilitates several critical attack scenarios defined by the MITRE ATT&CK framework. Specifically, it aligns with T1556: Modifying Authentication Processes and T1078: Valid Accounts, as the attacker leverages valid credentials to execute malicious code. The primary risks include session hijacking, where the attacker steals cookies or authentication tokens to impersonate the victim indefinitely. It also enables credential theft if the injected script captures login forms or sensitive data displayed on the page. Furthermore, privilege escalation is possible if the administrator performs actions that modify network configurations, potentially leading to widespread service disruption or unauthorized access to other systems connected via Nautobot.
To mitigate this vulnerability and prevent future occurrences of stored cross-site scripting attacks, it is imperative for organizations running affected versions of Nautobot to upgrade immediately to version 2.4.37 or later in the stable branch, or version 3.1.8 and above in the development branch. These releases contain patches that ensure proper input validation and output encoding, preventing raw HTML from being rendered as executable code even when the safe filter is applied. In environments where upgrading is not immediately feasible, administrators should enforce strict access controls to limit who holds the specific permissions required to write to these fields. Additionally, implementing a Content Security Policy (CSP) header can help mitigate the impact by restricting the sources from which scripts are allowed to execute, thereby reducing the effectiveness of injected payloads even if they manage to bypass other defenses. Regular security audits and code reviews focusing on template rendering logic should be conducted to ensure that no similar patterns exist elsewhere in the application architecture.