PT-2026-105859

Impact What kind of vulnerability is it? Who is impacted? It has two related instances that share the same root cause: a user-controlled model field is assigned verbatim to a form field's help text, which is rendered with Django's |safe filter render field.html, bypassing auto-escaping. In both...

CVE-2026-83801

Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.37 and 3.1.8, a user with extras.addrelationship or extras.changerelationship permission can store HTML or JavaScript in a Relationship description, and a user with dcim.addmodulefamily or dcim.changemodulefamily...

CVE-2026-83801 Nautobot: Stored cross-site scripting (XSS) in object create/edit form help text

Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.37 and 3.1.8, a user with extras.addrelationship or extras.changerelationship permission can store HTML or JavaScript in a Relationship description, and a user with dcim.addmodulefamily or dcim.changemodulefamily...

CVE-2026-83801 Nautobot: Stored cross-site scripting (XSS) in object create/edit form help text

Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.37 and 3.1.8, a user with extras.addrelationship or extras.changerelationship permission can store HTML or JavaScript in a Relationship description, and a user with dcim.addmodulefamily or dcim.changemodulefamily...

EUVD-2026-84814

Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.37 and 3.1.8, a user with extras.addrelationship or extras.changerelationship permission can store HTML or JavaScript in a Relationship description, and a user with dcim.addmodulefamily or dcim.changemodulefamily...

CVE-2026-83801 Nautobot: Stored cross-site scripting (XSS) in object create/edit form help text

Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.37 and 3.1.8, a user with extras.addrelationship or extras.changerelationship permission can store HTML or JavaScript in a Relationship description, and a user with dcim.addmodulefamily or dcim.changemodulefamily...

CVE-2026-83801

Nautobot is vulnerable to Stored Cross-Site Scripting (XSS) in versions prior to 2.4.37 and 3.1.8 . The root cause is the lack of adequate neutralization when user-controlled values—specifically Relationship descriptions (requiring extras.add_relationship / extras.change_relationship) or Module F...

CVE-2026-83801: Improper Neutralization of Input During Web Page Generation

Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.37 and 3.1.8, a user with extras.addrelationship or extras.changerelationship permission can store HTML or JavaScript in a Relationship description, and a user with dcim.addmodulefamily or dcim.changemodulefamily...

PT-2026-97022

Name of the Vulnerable Software and Affected Versions Nautobot versions prior to 2.4.37 Nautobot versions prior to 3.1.8 Description Users with specific permissions can store HTML or JavaScript in a Relationship description or a Module Family name. Nautobot assigns these values to form field help...