CVE-2026-83801: Stored Cross-Site Scripting via Form Help Text in Nautobot

Nautobot serves as an open-source Network Source of Truth and Network Automation Platform, managing highly sensitive configuration data. The application utilizes a generic form rendering component to display form fields dynamically across different modules. A critical validation flaw exists in how user-supplied database properties are parsed during this form generation process.

The vulnerability is classified as a stored Cross-Site Scripting (XSS) vulnerability, registered as CWE-79. Specifically, the application interpolates user-controlled database properties directly into the help text parameter of standard Django form fields. These fields are subsequently rendered without appropriate contextual escaping.

An attacker with low-level administrative privileges can inject arbitrary HTML or JavaScript payloads into specific model properties. When a high-privilege administrative user accesses the affected object forms, the browser executes the stored payload. This execution occurs within the context of the victim's authenticated session, introducing significant security risks.

In standard Django applications, template variables are automatically HTML-escaped by default to prevent cross-site scripting vulnerabilities. However, Nautobot utilizes a specialized template file named render_field.html to standardize the visual presentation of form elements. Within this template, the form field's help_text parameter is processed using Django's built-in |safe template filter.

The application of the |safe filter instructs the template engine to bypass standard HTML auto-escaping mechanisms. This behavior assumes that any content passed to help_text has been validated and sanitized. If the backend dynamic form class assigns raw, unescaped, user-controlled model attributes directly to the form's help_text property, a persistent injection path is established.

The vulnerability manifests in two primary code paths. First, in the Module Family initialization logic within nautobot/dcim/forms.py, the system generates help texts using standard Python f-strings that incorporate the unsanitized parent_bay.module_family.name attribute. Second, in nautobot/extras/models/relationships.py, the dynamic relationship form builder directly maps the unsanitized self.description attribute to the field's help text parameter.

The vulnerability in the Module Family component was addressed by replacing standard Python f-string interpolation with Django's format_html utility, which automatically escapes variable inputs.

# Vulnerable Implementation
self.fields["module_family"].help_text = f"The selected parent module bay requires a module in the {parent_bay.module_family.name} family"
 
# Patched Implementation
from django.utils.html import format_html
 
self.fields["module_family"].help_text = format_html(
    "The selected parent module bay requires a module in the {} family",
    parent_bay.module_family.name,
)

For the Relationship description component, the developers implemented markdown-based sanitization using the render_markdown helper. This helper leverages the nh3 HTML sanitization library to strip out executable components like <script> tags while retaining benign formatting elements.

# Vulnerable Implementation
def to_form_field(self, side):
    field.required = False
    field.label = self.get_label(side)
    if self.description:
        field.help_text = self.description
    return field
 
# Patched Implementation
from nautobot.core.templatetags.helpers import render_markdown
 
def to_form_field(self, side):
    field.required = False
    field.label = self.get_label(side)
    if self.description:
        # Sanitize input and render markdown securely
        field.help_text = render_markdown(self.description)
    return field

Exploitation of this vulnerability requires an authenticated attacker with permissions to modify either Module Family names or Relationship descriptions. The attacker injects a target payload containing executable JavaScript into these fields. Because the inputs are stored in the database without prior validation, the database persists the malicious payload in its raw form.

The attack remains dormant until an administrative user triggers the rendering of the compromised form. This occurs when the administrator attempts to create or edit objects associated with the malicious Module Family or Relationship. The system loads the record, extracts the raw payload, and renders it through the render_field.html template.

Upon rendering, the administrator's browser interprets the injected tags and executes the script. The script can extract the active session cookies or API tokens and transmit them to an external endpoint controlled by the attacker. This allows the attacker to hijack the session and assume the administrative identity.

The security impact of CVE-2026-83801 is evaluated with a CVSS v3.1 score of 5.4, indicating Medium severity. The attack vector is Network, requiring Low privileges and User Interaction. The scope is changed because the script executes within the context of the victim's session, enabling actions outside the attacker's original permission boundaries.

Successful execution allows an attacker to bypass role-based access control. Since Nautobot serves as a centralized source of truth for network configurations, administrative access can lead to broader infrastructure compromise. The attacker can modify network device definitions, retrieve secrets, or disrupt automation workflows.

The vulnerability does not present direct availability risks to the server hosting Nautobot. The primary consequence is the compromise of session confidentiality and integrity. If the victim holds superuser privileges, the attacker can establish full, persistent administrative control over the Nautobot deployment.

The recommended remediation is to upgrade the Nautobot deployment to the patched releases. For deployments on the v2.x release train, upgrade to version v2.4.37 or later. For deployments on the v3.x release train, upgrade to version v3.1.8 or later.

If immediate upgrading is not possible, organizations can run administrative scripts within the Nautobot Django shell to inspect and clean the database. This script scans for potentially dangerous characters in target models.

# Audit script for the Django shell
from nautobot.dcim.models import ModuleFamily
from nautobot.extras.models import Relationship
 
for mf in ModuleFamily.objects.filter(name__contains='<'):
    print(f'Vulnerable ModuleFamily: {mf.id}')
 
for rel in Relationship.objects.filter(description__contains='<'):
    print(f'Vulnerable Relationship: {rel.id}')

Additionally, organizations should enforce the principle of least privilege. Restricting access to the dcim.add_modulefamily, dcim.change_modulefamily, extras.add_relationship, and extras.change_relationship permissions reduces the exposed attack surface.