DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-83801: CVE-2026-83801: Stored Cross-Site Scripting via Form Help Text in Nautobot

#security #cve #cybersecurity

CVE-2026-83801: Stored Cross-Site Scripting via Form Help Text in Nautobot

Vulnerability ID: CVE-2026-83801
CVSS Score: 5.4
Published: 2026-09-22

CVE-2026-83801 is a stored Cross-Site Scripting (XSS) vulnerability in Nautobot. The vulnerability arises because the application interpolates user-controlled database properties—specifically Relationship descriptions and Module Family names—directly into the help_text parameter of Django form fields. These fields are rendered using Django's |safe filter, bypassing HTML escaping and enabling persistent injection. When an administrative user accesses the affected forms, the payload executes contextually in their browser. This allows attackers to hijack active sessions and perform unauthorized operations. Nautobot versions prior to v2.4.37 and v3.1.8 are affected by this vulnerability. The issue has been patched by implementing contextual HTML escaping and strict markdown sanitization.

TL;DR

A stored XSS vulnerability in Nautobot allows low-privileged administrative users to inject malicious scripts into Module Family names or Relationship descriptions, executing arbitrary code when viewed by other users.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-79
  • Attack Vector: Network
  • CVSS Severity: 5.4 (Medium)
  • EPSS Status: Not established
  • Impact: Stored Cross-Site Scripting (XSS)
  • Exploit Status: Proof-of-Concept
  • KEV Status: Not Listed

Affected Systems

  • Nautobot v2.x before v2.4.37
  • Nautobot v3.x before v3.1.8
  • Nautobot: >= 2.0.0, < 2.4.37 (Fixed in: v2.4.37)
  • Nautobot: >= 3.0.0, < 3.1.8 (Fixed in: v3.1.8)

Code Analysis

Commit: e6ff20d

Remediate dynamic form helper text injection in Module Family and Relationship models

Commit: f8a6246

Apply markdown and nh3 sanitization to relationship description field

Mitigation Strategies

  • Upgrade to patched versions
  • Restrict form-modifying administrative permissions
  • Sanitize database entries containing potential payloads

Remediation Steps:

  1. Identify current Nautobot version
  2. If on v2.x, upgrade to v2.4.37 or later
  3. If on v3.x, upgrade to v3.1.8 or later
  4. Run diagnostic queries to check for existing script tags in ModuleFamily and Relationship models

References

Read the full report for CVE-2026-83801 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)