{"id":"CVE-2026-83801","aliases":["GHSA-56v6-2fhr-wxgq","PYSEC-2026-4110"],"url":"https://o3.security/vulnerability/CVE-2026-83801","summary":"Nautobot: Stored cross-site scripting (XSS) in object create/edit form help text","details":"### Impact\n_What kind of vulnerability is it? Who is impacted?_\n\nIt has two related instances that share the same root cause: a user-controlled model field is assigned verbatim to a form field's `help_text`, which is rendered with Django's `|safe` filter (`render_field.html`), bypassing auto-escaping.\n\nIn both cases the script executes in the browser of any user who opens an affected create or edit form, **including administrators and superusers**. Because the payload runs in the victim's authenticated session, it can lead to actions performed as the victim, session/token theft, and further privilege escalation. Exploitation requires the victim to open an affected form.\n\n#### Relationship description\n\nA user who holds the add/change permission for Relationships (`extras.add_relationship` / `extras.change_relationship`) can set a Relationship's **description** to an HTML/JavaScript payload. That description is used as the help text of the relationship's form field and is rendered on the create/edit page of every object type the relationship applies to.\n\n#### Module Family name\n\nA user who holds the add/change permission for Module Families (`dcim.add_modulefamily` / `dcim.change_modulefamily`) can put a payload in a Module Family **name**, which is interpolated into the `module_family` field's help text on the Module \"Install module\" form for any module bay assigned to that family.\n\n### Patches\n_Has the problem been patched? What versions should users upgrade to?_\n\nFixes are available in Nautobot v2.4.37+ & v3.1.8+\n\n> Note: The underlying weakness exists in earlier EOL versions of Nautobot (v1.x). Users on those older EOL versions are highly encouraged to upgrade to a supported version.\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\n\nThere is no configuration-only fix. To remediate without upgrading:\n\n- Restrict the `extras.add_relationship` / `extras.change_relationship` and `dcim.add_modulefamily` / `dcim.change_modulefamily` permissions to fully trusted administrators only.\n- Audit existing Relationship **description** values and Module Family **name** values for embedded HTML / `<script>` content and remove any payloads.\n\nNote that limiting who can open create/edit forms does not fully mitigate the issue, since the payload targets any user (including admins) who opens an affected form.\n\n### Credit\n\nCredit for this discovery goes to Habibullo Izzatilloyev.","published":"2026-09-22T19:44:47.472Z","modified":"2026-10-21T03:00:28.157427164Z","cvss":{"score":5.4,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"PyPI","name":"nautobot","fixedVersion":"2.4.37"},{"ecosystem":"PyPI","name":"nautobot","fixedVersion":"3.1.8"}],"fix":{"url":"https://github.com/nautobot/nautobot/commit/e6ff20d50e0759135c6d278e7b2ceec56ed9b3c8","label":"nautobot/nautobot@e6ff20d"},"references":[{"type":"WEB","url":"https://github.com/nautobot/nautobot/releases/tag/v2.4.37"},{"type":"WEB","url":"https://github.com/nautobot/nautobot/releases/tag/v3.1.8"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/83xxx/CVE-2026-83801.json"},{"type":"ADVISORY","url":"https://github.com/nautobot/nautobot/security/advisories/GHSA-56v6-2fhr-wxgq"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83801"},{"type":"FIX","url":"https://github.com/nautobot/nautobot/commit/e6ff20d50e0759135c6d278e7b2ceec56ed9b3c8"},{"type":"FIX","url":"https://github.com/nautobot/nautobot/commit/f8a62466f3ebc42759a6373e7c79b0cad5751c2f"},{"type":"PACKAGE","url":"https://github.com/nautobot/nautobot"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-21T03:00:28.157427164Z"}}