https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Sun, 27 Sep 2026 05:11:57 +0000 https://vulnerability.circl.lu/sighting/03adfa94-b11b-47cd-9534-24ab238bd10c/export {"uuid": "03adfa94-b11b-47cd-9534-24ab238bd10c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-83801", "type": "seen", "source": "https://gist.github.com/alon710/f4948b85008393550183db83af47c6eb", "content": "# CVE-2026-83801: CVE-2026-83801: Stored Cross-Site Scripting via Form Help Text in Nautobot\n\n> **CVSS Score:** 5.4\n> **Published:** 2026-09-22\n> **Full Report:** https://cvereports.com/reports/CVE-2026-83801\n\n## Summary\nCVE-2026-83801 is a stored Cross-Site Scripting (XSS) vulnerability in Nautobot. The vulnerability arises because the application interpolates user-controlled database properties\u2014specifically Relationship descriptions and Module Family names\u2014directly into the help_text parameter of Django form fields. These fields are rendered using Django's |safe filter, bypassing HTML escaping and enabling persistent injection. When an administrative user accesses the affected forms, the payload executes contextually in their browser. This allows attackers to hijack active sessions and perform unauthorized operations. Nautobot versions prior to v2.4.37 and v3.1.8 are affected by this vulnerability. The issue has been patched by implementing contextual HTML escaping and strict markdown sanitization.\n\n## TL;DR\nA stored XSS vulnerability in Nautobot allows low-privileged administrative users to inject malicious scripts into Module Family names or Relationship descriptions, executing arbitrary code when viewed by other users.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-79\n- **Attack Vector**: Network\n- **CVSS Severity**: 5.4 (Medium)\n- **EPSS Status**: Not established\n- **Impact**: Stored Cross-Site Scripting (XSS)\n- **Exploit Status**: Proof-of-Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Nautobot v2.x before v2.4.37\n- Nautobot v3.x before v3.1.8\n- **Nautobot**: >= 2.0.0, < 2.4.37 (Fixed in: `v2.4.37`)\n- **Nautobot**: >= 3.0.0, < 3.1.8 (Fixed in: `v3.1.8`)\n\n## Mitigation\n\n- Upgrade to patched versions\n- Restrict form-modifying administrative permissions\n- Sanitize database entries containing potential payloads\n\n**Remediation Steps:**\n1. Identify current Nautobot version\n2. If on v2.x, upgrade to v2.4.37 or later\n3. If on v3.x, upgrade to v3.1.8 or later\n4. Run diagnostic queries to check for existing script tags in ModuleFamily and Relationship models\n\n## References\n\n- [GitHub Security Advisory GHSA-56v6-2fhr-wxgq](https://github.com/nautobot/nautobot/security/advisories/GHSA-56v6-2fhr-wxgq)\n- [NVD - CVE-2026-83801](https://nvd.nist.gov/vuln/detail/CVE-2026-83801)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-83801) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-23T13:31:59.806926Z"} {"uuid": "03adfa94-b11b-47cd-9534-24ab238bd10c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-83801", "type": "seen", "source": "https://gist.github.com/alon710/f4948b85008393550183db83af47c6eb", "content": "# CVE-2026-83801: CVE-2026-83801: Stored Cross-Site Scripting via Form Help Text in Nautobot\n\n> **CVSS Score:** 5.4\n> **Published:** 2026-09-22\n> **Full Report:** https://cvereports.com/reports/CVE-2026-83801\n\n## Summary\nCVE-2026-83801 is a stored Cross-Site Scripting (XSS) vulnerability in Nautobot. The vulnerability arises because the application interpolates user-controlled database properties\u2014specifically Relationship descriptions and Module Family names\u2014directly into the help_text parameter of Django form fields. These fields are rendered using Django's |safe filter, bypassing HTML escaping and enabling persistent injection. When an administrative user accesses the affected forms, the payload executes contextually in their browser. This allows attackers to hijack active sessions and perform unauthorized operations. Nautobot versions prior to v2.4.37 and v3.1.8 are affected by this vulnerability. The issue has been patched by implementing contextual HTML escaping and strict markdown sanitization.\n\n## TL;DR\nA stored XSS vulnerability in Nautobot allows low-privileged administrative users to inject malicious scripts into Module Family names or Relationship descriptions, executing arbitrary code when viewed by other users.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-79\n- **Attack Vector**: Network\n- **CVSS Severity**: 5.4 (Medium)\n- **EPSS Status**: Not established\n- **Impact**: Stored Cross-Site Scripting (XSS)\n- **Exploit Status**: Proof-of-Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Nautobot v2.x before v2.4.37\n- Nautobot v3.x before v3.1.8\n- **Nautobot**: >= 2.0.0, < 2.4.37 (Fixed in: `v2.4.37`)\n- **Nautobot**: >= 3.0.0, < 3.1.8 (Fixed in: `v3.1.8`)\n\n## Mitigation\n\n- Upgrade to patched versions\n- Restrict form-modifying administrative permissions\n- Sanitize database entries containing potential payloads\n\n**Remediation Steps:**\n1. Identify current Nautobot version\n2. If on v2.x, upgrade to v2.4.37 or later\n3. If on v3.x, upgrade to v3.1.8 or later\n4. Run diagnostic queries to check for existing script tags in ModuleFamily and Relationship models\n\n## References\n\n- [GitHub Security Advisory GHSA-56v6-2fhr-wxgq](https://github.com/nautobot/nautobot/security/advisories/GHSA-56v6-2fhr-wxgq)\n- [NVD - CVE-2026-83801](https://nvd.nist.gov/vuln/detail/CVE-2026-83801)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-83801) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-23T13:31:59.806926Z"} https://vulnerability.circl.lu/sighting/03adfa94-b11b-47cd-9534-24ab238bd10c/export Wed, 23 Sep 2026 13:31:59 +0000