PYSEC-2026-1686

See a problem?
Import Source
https://github.com/pypa/advisory-database/blob/main/vulns/nautobot/PYSEC-2026-1686.yaml
JSON Data
https://api.osv.dev/v1/vulns/PYSEC-2026-1686
Aliases
Published
2026-07-07T11:45:40.353768Z
Modified
2026-07-07T17:47:06.482244151Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:L CVSS Calculator
Summary
nautobot has reflected Cross-site Scripting potential in all object list views
Details

Impact

It was discovered that due to improper handling and escaping of user-provided query parameters, a maliciously crafted Nautobot URL could potentially be used to execute a Reflected Cross-Site Scripting (Reflected XSS) attack against users. All filterable object-list views in Nautobot are vulnerable, including:

  • /dcim/location-types/
  • /dcim/locations/
  • /dcim/racks/
  • /dcim/rack-groups/
  • /dcim/rack-reservations/
  • /dcim/rack-elevations/
  • /tenancy/tenants/
  • /tenancy/tenant-groups/
  • /extras/tags/
  • /extras/statuses/
  • /extras/roles/
  • /extras/dynamic-groups/
  • /dcim/devices/
  • /dcim/platforms/
  • /dcim/virtual-chassis/
  • /dcim/device-redundancy-groups/
  • /dcim/interface-redundancy-groups/
  • /dcim/device-types/
  • /dcim/manufacturers/
  • /dcim/cables/
  • /dcim/console-connections/
  • /dcim/power-connections/
  • /dcim/interface-connections/
  • /dcim/interfaces/
  • /dcim/front-ports/
  • /dcim/rear-ports/
  • /dcim/console-ports/
  • /dcim/console-server-ports/
  • /dcim/power-ports/
  • /dcim/power-outlets/
  • /dcim/device-bays/
  • /dcim/inventory-items/
  • /ipam/ip-addresses/
  • /ipam/prefixes
  • /ipam/rirs/
  • /ipam/namespaces/
  • /ipam/vrfs/
  • /ipam/route-targets/
  • /ipam/vlans/
  • /ipam/vlan-groups/
  • /ipam/services/
  • /virtualization/virtual-machines/
  • /virtualization/interfaces/
  • /virtualization/clusters/
  • /virtualization/cluster-types/
  • /virtualization/cluster-groups/
  • /circuits/circuits/
  • /circuits/circuit-types/
  • /circuits/providers/
  • /circuits/provider-networks/
  • /dcim/power-feeds/
  • /dcim/power-panels/
  • /extras/secrets/
  • /extras/secrets-groups/
  • /extras/jobs/
  • /extras/jobs/scheduled-jobs/approval-queue/
  • /extras/jobs/scheduled-jobs/
  • /extras/job-results/
  • /extras/job-hooks/
  • /extras/job-buttons/
  • /extras/object-changes/
  • /extras/git-repositories/
  • /extras/graphql-queries/
  • /extras/relationships/
  • /extras/notes/
  • /extras/config-contexts/
  • /extras/config-context-schemas/
  • /extras/export-templates/
  • /extras/external-integrations/
  • /extras/webhooks/
  • /extras/computed-fields/
  • /extras/custom-fields/
  • /extras/custom-links/

as well as any similar object-list views provided by any Nautobot App.

Patches

Fixed in Nautobot 1.6.20 and 2.2.3.

Workarounds

No workaround has been identified

References

  • #5646
  • #5647

Credit to Michael Panorios for reporting this issue.

References

Affected packages

PyPI / nautobot

Package

Name
nautobot
View open source insights on deps.dev
Purl
pkg:pypi/nautobot

Affected ranges

Type
ECOSYSTEM
Events
Introduced
1.5.0
Fixed
1.6.20
Introduced
2.0.0
Fixed
2.2.3

Affected versions

1.*
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
1.5.6
1.5.7
1.5.8
1.5.9
1.5.10
1.5.11
1.5.12
1.5.13
1.5.14
1.5.15
1.5.16
1.5.17
1.5.18
1.5.19
1.5.20
1.5.21
1.5.22
1.5.23
1.5.24
1.6.0
1.6.1
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.6.7
1.6.8
1.6.9
1.6.10
1.6.11
1.6.12
1.6.13
1.6.14
1.6.15
1.6.16
1.6.17
1.6.18
1.6.19
2.*
2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.1.0b1
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.2.0b1
2.2.0
2.2.1
2.2.2

Database specific

source 
"https://github.com/pypa/advisory-database/blob/main/vulns/nautobot/PYSEC-2026-1686.yaml"