---
id: CVE-2024-23345
aliases:
  - GHSA-v4xv-795h-rv4h
  - PYSEC-2024-16
title: 'XSS potential in rendered Markdown fields (comments, description, notes, etc.)'
summary: 'XSS potential in rendered Markdown fields (comments, description, notes, etc.)'
severity: high
cvss: 7.1
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:L'
vendor: nautobot
product: nautobot
ecosystem: pip
affected:
  - 'nautobot >= 2.0.0, < 2.1.2'
  - nautobot < 1.6.10
patched:
  - nautobot 2.1.2
  - nautobot 1.6.10
published: '2024-01-23'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:50:09.620510398Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-v4xv-795h-rv4h'
references:
  - url: >-
      https://github.com/nautobot/nautobot/security/advisories/GHSA-v4xv-795h-rv4h
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2024-23345'
  - url: 'https://github.com/nautobot/nautobot/pull/5133'
  - url: 'https://github.com/nautobot/nautobot/pull/5134'
  - url: >-
      https://github.com/nautobot/nautobot/commit/17effcbe84a72150c82b138565c311bbee357e80
  - url: >-
      https://github.com/nautobot/nautobot/commit/64312a4297b5ca49b6cdedf477e41e8e4fd61cce
  - url: 'https://github.com/nautobot/nautobot'
  - url: >-
      https://github.com/pypa/advisory-database/tree/main/vulns/nautobot/PYSEC-2024-16.yaml
tags:
  - osv
  - pip
epss: 0.00433
epssPercentile: 0.34888
ingestedAt: '2026-09-12T03:13:01.729Z'
---

## Overview

### Impact

All users of Nautobot versions earlier than 1.6.10 or 2.1.2 are potentially impacted.

Due to inadequate input sanitization, any user-editable fields that support Markdown rendering, including:

- `Circuit.comments`
- `Cluster.comments`
- `CustomField.description`
- `Device.comments`
- `DeviceRedundancyGroup.comments`
- `DeviceType.comments`
- `Job.description`
- `JobLogEntry.message`
- `Location.comments`
- `Note.note`
- `PowerFeed.comments`
- `Provider.noc_contact`
- `Provider.admin_contact`
- `Provider.comments`
- `ProviderNetwork.comments`
- `Rack.comments`
- `Tenant.comments`
- `VirtualMachine.comments`
- Contents of any custom fields of type `markdown`
- Job class `description` attributes
- The `SUPPORT_MESSAGE` system configuration setting

are potentially susceptible to cross-site scripting (XSS) attacks via maliciously crafted data.

### Patches

Fixed in Nautobot versions 1.6.10 and 2.1.2.

### References

https://github.com/nautobot/nautobot/pull/5133
https://github.com/nautobot/nautobot/pull/5134


## Affected packages

- `nautobot >= 2.0.0, < 2.1.2`
- `nautobot < 1.6.10`

## Remediation

Upgrade to a patched release:

- `nautobot 2.1.2`
- `nautobot 1.6.10`