CVE-2024-23345High· 7.1▾ TwilightXSS potential in rendered Markdown fields (comments, description, notes, etc.)
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 39.1 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 12.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.4%
All users of Nautobot versions earlier than 1.6.10 or 2.1.2 are potentially impacted.
Due to inadequate input sanitization, any user-editable fields that support Markdown rendering, including:
Circuit.commentsCluster.commentsCustomField.descriptionDevice.commentsDeviceRedundancyGroup.commentsDeviceType.commentsJob.descriptionJobLogEntry.messageLocation.commentsNote.notePowerFeed.commentsProvider.noc_contactProvider.admin_contactProvider.commentsProviderNetwork.commentsRack.commentsTenant.commentsVirtualMachine.commentsmarkdowndescription attributesSUPPORT_MESSAGE system configuration settingare potentially susceptible to cross-site scripting (XSS) attacks via maliciously crafted data.
Fixed in Nautobot versions 1.6.10 and 2.1.2.
https://github.com/nautobot/nautobot/pull/5133 https://github.com/nautobot/nautobot/pull/5134
nautobot >= 2.0.0, < 2.1.2nautobot < 1.6.10Upgrade to a patched release:
nautobot 2.1.2nautobot 1.6.10Connected by shared product, vendor, weakness, or advisory.
CVE-2023-46128High· 7.7Nautobot vulnerable to exposure of hashed user passwords via REST API
CVE-2023-50263Low· 3.7Unauthenticated db-file-storage views
CVE-2026-34203Low· 2.7Nautobot: Management of users via REST API does not apply configured password validators
CVE-2026-44794Medium· 5.4Nautobot: REST API permits creation of GenericForeignKey references to objects that the user should not be able to reference
CVE-2026-44796Medium· 6.5Nautobot: Object bulk rename UI actions vulnerable to denial of service by crafted regular expression (REDoS)
CVE-2026-44798High· 7.1Nautobot: GitRepository.current_head field should not be writable through REST API