Cross-site scripting in Nautobot - #VU162768
Published: November 9, 2026
Vulnerability identifier: #VU162768
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: N/A
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an authenticated attacker to execute JavaScript in another Nautobot user's session, including an administrator's.
The vulnerability exists due to unescaped device type model names and software version aliases or version strings in software image summaries on Device, Virtual Machine and Inventory Item create or edit forms. An authenticated attacker with permission to add or change these records can inject scripts that read data or make changes as the victim when the victim opens a form referencing the affected record.
Affected software
Nautobot
Remediation
Install security update from vendor's website.
Nautobot - addressed in versions 2.4.45, 3.2.8