CVE-2026-83801: Nautobot Cross-Site Scripting Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-56v6-2fhr-wxgq",
  "modified" : "2026-09-22T20:37:30Z",
  "published" : "2026-09-22T20:37:30Z",
  "aliases" : [ "CVE-2026-83801" ],
  "summary" : "Nautobot: Stored cross-site scripting (XSS) in object create/edit form help text",
  "details" : "### Impact\n_What kind of vulnerability is it? Who is impacted?_\n\nIt has two related instances that share the same root cause: a user-controlled model field is assigned verbatim to a form field's `help_text`, which is rendered with Django's `|safe` filter (`render_field.html`), bypassing auto-escaping.\n\nIn both cases the script executes in the browser of any user who opens an affected create or edit form, **including administrators and superusers**. Because the payload runs in the victim's authenticated session, it can lead to actions performed as the victim, session/token theft, and further privilege escalation. Exploitation requires the victim to open an affected form.\n\n#### Relationship description\n\nA user who holds the add/change permission for Relationships (`extras.add_relationship` / `extras.change_relationship`) can set a Relationship's **description** to an HTML/JavaScript payload. That description is used as the help text of the relationship's form field and is rendered on the create/edit page of every object type the relationship applies to.\n\n#### Module Family name\n\nA user who holds the add/change permission for Module Families (`dcim.add_modulefamily` / `dcim.change_modulefamily`) can put a payload in a Module Family **name**, which is interpolated into the `module_family` field's help text on the Module \"Install module\" form for any module bay assigned to that family.\n\n### Patches\n_Has the problem been patched? What versions should users upgrade to?_\n\nFixes are available in Nautobot v2.4.37+ & v3.1.8+\n\n> Note: The underlying weakness exists in earlier EOL versions of Nautobot (v1.x). Users on those older EOL versions are highly encouraged to upgrade to a supported version.\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\n\nThere is no configuration-only fix. To remediate without upgrading:\n\n- Restrict the `extras.add_relationship` / `extras.change_relationship` and `dcim.add_modulefamily` / `dcim.change_modulefamily` permissions to fully trusted administrators only.\n- Audit existing Relationship **description** values and Module Family **name** values for embedded HTML / `<script>` content and remove any payloads.\n\nNote that limiting who can open create/edit forms does not fully mitigate the issue, since the payload targets any user (including admins) who opens an affected form.\n\n### Credit\n\nCredit for this discovery goes to Habibullo Izzatilloyev.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "nautobot"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "2.4.37"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "nautobot"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "3.0.0"
      }, {
        "fixed" : "3.1.8"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/nautobot/nautobot/security/advisories/GHSA-56v6-2fhr-wxgq"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/nautobot/nautobot/commit/e6ff20d50e0759135c6d278e7b2ceec56ed9b3c8"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/nautobot/nautobot/commit/f8a62466f3ebc42759a6373e7c79b0cad5751c2f"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/nautobot/nautobot"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/nautobot/nautobot/releases/tag/v2.4.37"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/nautobot/nautobot/releases/tag/v3.1.8"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-79" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-09-22T20:37:30Z",
    "nvd_published_at" : null
  }
}