CVE-2023-48705: Cross-site Scripting potential in Nautobot
Summary
CVE-2023-48705: Cross-site Scripting potential in custom links, job buttons, and computed fields. Affects nautobot across 2 version ranges.
< 1.6.6
>= 2.0.0, < 2.0.5
Fixed in 1.6.6 or 2.0.5, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Nautobot is an open-source platform that provides network automation and infrastructure management capabilities. It allows users to create custom links, job buttons, and computed fields to enhance their network management workflows. However, versions prior to 1.6.6 and 2.0.5 are vulnerable to a cross-site scripting (XSS) attack.
Vulnerability Detail
The vulnerability arises from incorrect usage of Django's mark_safe() API when rendering user-authored content such as custom links, job buttons, and computed fields. This flaw enables users with permission to create or edit these types of content to inject malicious payloads, including JavaScript code, which can be executed when rendering pages containing this content. This XSS vulnerability poses a significant risk to the confidentiality and integrity of user data.
How To Fix
Latest published version: 3.2.7 as of 23 Oct 2026
pip install --upgrade "nautobot==3.2.7"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.6.61.6.6pip install --upgrade "nautobot==1.6.6" -
>= 2.0.0, < 2.0.52.0.5pip install --upgrade "nautobot==2.0.5"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
While there is no direct fix available without upgrading, users can apply appropriate object permissions to restrict which users are permitted to create or edit custom links, job buttons, and computed fields. By limiting access to these features, the risk of exploitation can be mitigated.
Conclusion
In conclusion, Nautobot versions prior to 1.6.6 and 2.0.5 are vulnerable to a cross-site scripting (XSS) attack. Upgrading to the latest versions is crucial to mitigate this risk. Users can also apply object permissions to limit access to the affected features. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for nautobot →
FAQ
All versions of Nautobot prior to 1.6.6 and 2.0.5 are potentially affected.
The vulnerability allows users to inject malicious payloads, potentially leading to unauthorized access, data manipulation, and other security breaches.
Applying appropriate object permissions to restrict user access to custom links, job buttons, and computed fields can help mitigate the risk. However, upgrading to the latest versions of Nautobot is the recommended solution.
Yes, you can find more information about the vulnerability and the fixes in the following resources:
The vulnerability has a CVSS score of 7.1, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for nautobot.
