{"id":"CVE-2024-32979","aliases":["GHSA-jxgr-gcj5-cqqg","PYSEC-2026-1686"],"title":"nautobot has reflected Cross-site Scripting potential in all object list views","summary":"nautobot has reflected Cross-site Scripting potential in all object list views","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:L","vendor":"nautobot","product":"nautobot","ecosystem":"pip","affected":["nautobot >= 1.5.0, < 1.6.20","nautobot >= 2.0.0, < 2.2.3"],"patched":["nautobot 1.6.20","nautobot 2.2.3"],"published":"2024-05-01","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:50:13.904050315Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-jxgr-gcj5-cqqg","references":[{"url":"https://github.com/nautobot/nautobot/security/advisories/GHSA-jxgr-gcj5-cqqg"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-32979"},{"url":"https://github.com/nautobot/nautobot/pull/5646"},{"url":"https://github.com/nautobot/nautobot/pull/5647"},{"url":"https://github.com/nautobot/nautobot/commit/2ea5797ea43646d5d8b29433e4c707b5a9758146"},{"url":"https://github.com/nautobot/nautobot/commit/42440ebd9b381534ad89d62420ebea00d703d64e"},{"url":"https://github.com/nautobot/nautobot"},{"url":"https://github.com/nautobot/nautobot/releases/tag/v1.6.20"},{"url":"https://github.com/nautobot/nautobot/releases/tag/v2.2.3"}],"tags":["osv","pip"],"epss":0.00491,"epssPercentile":0.39641,"ingestedAt":"2026-07-08T18:25:50.907Z","slug":"CVE-2024-32979","body":"## Overview\n\n### Impact\n\nIt was discovered that due to improper handling and escaping of user-provided query parameters, a maliciously crafted Nautobot URL could potentially be used to execute a Reflected Cross-Site Scripting (Reflected XSS) attack against users. All filterable object-list views in Nautobot are vulnerable, including:\n\n- /dcim/location-types/\n- /dcim/locations/\n- /dcim/racks/\n- /dcim/rack-groups/\n- /dcim/rack-reservations/\n- /dcim/rack-elevations/\n- /tenancy/tenants/\n- /tenancy/tenant-groups/\n- /extras/tags/\n- /extras/statuses/\n- /extras/roles/\n- /extras/dynamic-groups/\n- /dcim/devices/\n- /dcim/platforms/\n- /dcim/virtual-chassis/\n- /dcim/device-redundancy-groups/\n- /dcim/interface-redundancy-groups/\n- /dcim/device-types/\n- /dcim/manufacturers/\n- /dcim/cables/\n- /dcim/console-connections/\n- /dcim/power-connections/\n- /dcim/interface-connections/\n- /dcim/interfaces/\n- /dcim/front-ports/\n- /dcim/rear-ports/\n- /dcim/console-ports/\n- /dcim/console-server-ports/\n- /dcim/power-ports/\n- /dcim/power-outlets/\n- /dcim/device-bays/\n- /dcim/inventory-items/\n- /ipam/ip-addresses/\n- /ipam/prefixes\n- /ipam/rirs/\n- /ipam/namespaces/\n- /ipam/vrfs/\n- /ipam/route-targets/\n- /ipam/vlans/\n- /ipam/vlan-groups/\n- /ipam/services/\n- /virtualization/virtual-machines/\n- /virtualization/interfaces/\n- /virtualization/clusters/\n- /virtualization/cluster-types/\n- /virtualization/cluster-groups/\n- /circuits/circuits/\n- /circuits/circuit-types/\n- /circuits/providers/\n- /circuits/provider-networks/\n- /dcim/power-feeds/\n- /dcim/power-panels/\n- /extras/secrets/\n- /extras/secrets-groups/\n- /extras/jobs/\n- /extras/jobs/scheduled-jobs/approval-queue/\n- /extras/jobs/scheduled-jobs/\n- /extras/job-results/\n- /extras/job-hooks/\n- /extras/job-buttons/\n- /extras/object-changes/\n- /extras/git-repositories/\n- /extras/graphql-queries/\n- /extras/relationships/\n- /extras/notes/\n- /extras/config-contexts/\n- /extras/config-context-schemas/\n- /extras/export-templates/\n- /extras/external-integrations/\n- /extras/webhooks/\n- /extras/computed-fields/\n- /extras/custom-fields/\n- /extras/custom-links/\n\nas well as any similar object-list views provided by any Nautobot App.\n\n### Patches\n\nFixed in Nautobot 1.6.20 and 2.2.3.\n\n### Workarounds\n\nNo workaround has been identified\n\n### References\n\n- #5646 \n- #5647\n\n**Credit to [Michael Panorios](mailto:michael.panorios@pwc.com) for reporting this issue.**\n\n## Affected packages\n\n- `nautobot >= 1.5.0, < 1.6.20`\n- `nautobot >= 2.0.0, < 2.2.3`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `nautobot 1.6.20`\n- `nautobot 2.2.3`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}