Description
Nautobot is a Network Source of Truth and Network Automation Platform built as a web application. All users of Nautobot versions earlier than 1.6.10 or 2.1.2 are potentially impacted by a cross-site scripting vulnerability. Due to inadequate input sanitization, any user-editable fields that support Markdown rendering, including are potentially susceptible to cross-site scripting (XSS) attacks via maliciously crafted data. This issue is fixed in Nautobot versions 1.6.10 and 2.1.2.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
nautobot nautobot
>= 2.0.0, < 2.1.2affected< 1.6.10affected
References
- https://github.com/nautobot/nautobot/security/advisories/GHSA-v4xv-795h-rv4h ↗
- https://github.com/nautobot/nautobot/pull/5133 ↗
- https://github.com/nautobot/nautobot/pull/5134 ↗
- https://github.com/nautobot/nautobot/commit/17effcbe84a72150c82b138565c311bbee357e80 ↗
- https://github.com/nautobot/nautobot/commit/64312a4297b5ca49b6cdedf477e41e8e4fd61cce ↗