Cross-site scripting in Nautobot - #VU162769
Published: November 9, 2026
Vulnerability identifier: #VU162769
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: N/A
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an authenticated attacker to execute arbitrary JavaScript in another Nautobot user's session, including an administrator's.
The vulnerability exists due to unescaped custom field labels and choice values on Nautobot's Import Objects page. An authenticated attacker can inject malicious content with permission to add or change custom fields or choices, gaining the victim's data access and modification capabilities when the victim opens the page for an applicable content type.
Affected software
Nautobot
Remediation
Install security update from vendor's website.
Nautobot - addressed in versions 2.4.45, 3.2.8