PYSEC-2026-4110 Nautobot: Stored cross-site scripting (XSS) in object create/edit form help text

Impact What kind of vulnerability is it? Who is impacted? It has two related instances that share the same root cause: a user-controlled model field is assigned verbatim to a form field's helptext, which is rendered with Django's |safe filter renderfield.html, bypassing auto-escaping. In both cas...

Nautobot: Stored cross-site scripting (XSS) in object create/edit form help text

ImpactWhat kind of vulnerability is it? Who is impacted?It has two related instances that share the same root cause: a user-controlled model field is assigned verbatim to a form field's helptext, which is rendered with Django's |safe filter renderfield.html, bypassing auto-escaping.In both cases...

Nautobot: Stored cross-site scripting (XSS) in object create/edit form help text

Impact What kind of vulnerability is it? Who is impacted? It has two related instances that share the same root cause: a user-controlled model field is assigned verbatim to a form field's helptext, which is rendered with Django's |safe filter renderfield.html, bypassing auto-escaping. In both cas...

CVE-2026-83801 Nautobot: Stored cross-site scripting (XSS) in object create/edit form help text

Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.37 and 3.1.8, a user with extras.addrelationship or extras.changerelationship permission can store HTML or JavaScript in a Relationship description, and a user with dcim.addmodulefamily or dcim.changemodulefamily...

Cross-site Scripting (XSS)

python-django-horizon is vulnerable to cross-site scripting XSS attacks. The vulnerability exists as the Orchestration/Stack section in OpenStack Dashboard Horizon 2014.2 before 2014.2.4 and 2015.1.x before 2015.1.1 allows remote attackers to inject arbitrary web script or HTML via the descriptio...

CVE-2015-3219: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Orchestration/Stack section in OpenStack Dashboard Horizon 2014.2 before 2014.2.4 and 2015.1.x before 2015.1.1 allows remote attackers to inject arbitrary web script or HTML via the description parameter in a heat template, which is not properly handl...