Every CVE Search/ Get API key

CVE-2024-23345

Nautobot has XSS potential in rendered Markdown fields

7.1 HighFix available

Nautobot is a Network Source of Truth and Network Automation Platform built as a web application. All users of Nautobot versions earlier than 1.6.10 or 2.1.2 are potentially impacted by a cross-site scripting vulnerability. Due to inadequate input sanitization, any user-editable fields that support Markdown rendering, including are potentially susceptible to cross-site scripting (XSS) attacks via maliciously crafted data. This issue is fixed in Nautobot versions 1.6.10 and 2.1.2.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
Low
User interaction
Required

What an attacker can affect

Confidentiality
Low
Integrity
High
Availability
Low

Exploit likelihood

0.43%Up 0.4 points since Jan 24, 2024
90%50%10%1%

What each source reports

CVE List Score used 7.1

Nautobot has XSS potential in rendered Markdown fields

Nautobot is a Network Source of Truth and Network Automation Platform built as a web application. All users of Nautobot versions earlier than 1.6.10 or 2.1.2 are potentially impacted by a cross-site scripting vulnerability. Due to inadequate input sanitization, any user-editable fields that support Markdown rendering, including are potentially susceptible to cross-site scripting (XSS) attacks via maliciously crafted data. This issue is fixed in Nautobot versions 1.6.10 and 2.1.2.

Record
CVE-2024-23345
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:L
Weakness
CWE-79
Updated
2026-11-02
EUVDEUVD-2024-0116 7.1

Nautobot is a Network Source of Truth and Network Automation Platform built as a web application. All users of Nautobot versions earlier than 1.6.10 or 2.1.2 are potentially impacted by a cross-site scripting vulnerability. Due to inadequate input sanitization, any user-editable fields that support Markdown rendering, including are potentially susceptible to cross-site scripting (XSS) attacks via maliciously crafted data. This issue is fixed in Nautobot versions 1.6.10 and 2.1.2.

Record
EUVD-2024-0116
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:L
Updated
2026-11-02
GitHub AdvisoriesGHSA-v4xv-795h-rv4h 7.1

XSS potential in rendered Markdown fields (comments, description, notes, etc.)

Impact

All users of Nautobot versions earlier than 1.6.10 or 2.1.2 are potentially impacted.

Due to inadequate input sanitization, any user-editable fields that support Markdown rendering, including:

  • Circuit.comments
  • Cluster.comments
  • CustomField.description
  • Device.comments
  • DeviceRedundancyGroup.comments
  • DeviceType.comments
  • Job.description
  • JobLogEntry.message
  • Location.comments
  • Note.note
  • PowerFeed.comments
  • Provider.noc_contact
  • Provider.admin_contact
  • Provider.comments
  • ProviderNetwork.comments
  • Rack.comments
  • Tenant.comments
  • VirtualMachine.comments
  • Contents of any custom fields of type markdown
  • Job class description attributes
  • The SUPPORT_MESSAGE system configuration setting

are potentially susceptible to cross-site scripting (XSS) attacks via maliciously crafted data.

Patches

Fixed in Nautobot versions 1.6.10 and 2.1.2.

References

https://github.com/nautobot/nautobot/pull/5133 https://github.com/nautobot/nautobot/pull/5134

Record
GHSA-v4xv-795h-rv4h
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:L
Weakness
CWE-79
Updated
2026-11-02
NVD 7.1

Nautobot is a Network Source of Truth and Network Automation Platform built as a web application. All users of Nautobot versions earlier than 1.6.10 or 2.1.2 are potentially impacted by a cross-site scripting vulnerability. Due to inadequate input sanitization, any user-editable fields that support Markdown rendering, including are potentially susceptible to cross-site scripting (XSS) attacks via maliciously crafted data. This issue is fixed in Nautobot versions 1.6.10 and 2.1.2.

Record
CVE-2024-23345
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:L
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSV 7.1

Nautobot has XSS potential in rendered Markdown fields

Nautobot is a Network Source of Truth and Network Automation Platform built as a web application. All users of Nautobot versions earlier than 1.6.10 or 2.1.2 are potentially impacted by a cross-site scripting vulnerability. Due to inadequate input sanitization, any user-editable fields that support Markdown rendering, including are potentially susceptible to cross-site scripting (XSS) attacks via maliciously crafted data. This issue is fixed in Nautobot versions 1.6.10 and 2.1.2.

Record
CVE-2024-23345
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:L
Weakness
CWE-79
Updated
2026-11-02
OSVGHSA-v4xv-795h-rv4h 7.1

XSS potential in rendered Markdown fields (comments, description, notes, etc.)

Impact

All users of Nautobot versions earlier than 1.6.10 or 2.1.2 are potentially impacted.

Due to inadequate input sanitization, any user-editable fields that support Markdown rendering, including:

  • Circuit.comments
  • Cluster.comments
  • CustomField.description
  • Device.comments
  • DeviceRedundancyGroup.comments
  • DeviceType.comments
  • Job.description
  • JobLogEntry.message
  • Location.comments
  • Note.note
  • PowerFeed.comments
  • Provider.noc_contact
  • Provider.admin_contact
  • Provider.comments
  • ProviderNetwork.comments
  • Rack.comments
  • Tenant.comments
  • VirtualMachine.comments
  • Contents of any custom fields of type markdown
  • Job class description attributes
  • The SUPPORT_MESSAGE system configuration setting

are potentially susceptible to cross-site scripting (XSS) attacks via maliciously crafted data.

Patches

Fixed in Nautobot versions 1.6.10 and 2.1.2.

References

https://github.com/nautobot/nautobot/pull/5133 https://github.com/nautobot/nautobot/pull/5134

Record
GHSA-v4xv-795h-rv4h
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:L
Weakness
CWE-79
Updated
2026-11-02
OSVPYSEC-2024-16 5.4

Nautobot is a Network Source of Truth and Network Automation Platform built as a web application. All users of Nautobot versions earlier than 1.6.10 or 2.1.2 are potentially impacted by a cross-site scripting vulnerability. Due to inadequate input sanitization, any user-editable fields that support Markdown rendering, including are potentially susceptible to cross-site scripting (XSS) attacks via maliciously crafted data. This issue is fixed in Nautobot versions 1.6.10 and 2.1.2.

Record
PYSEC-2024-16
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
nautobot
PyPI
 2.0.0 up to 2.1.2
2.1.2
nautobot
PyPI
 before 1.6.10
1.6.10
nautobot
PyPI
 2.0.0 up to 2.1.2, plus listed versions
2.0.12.0.22.0.32.0.42.0.5
Show 4 moreShow less
2.0.62.1.02.1.0b12.1.1
2.1.2
nautobot
PyPI
 before 1.6.10, plus listed versions
1.0.01.0.0a11.0.0a21.0.0b11.0.0b2
Show 45 moreShow less
1.0.0b31.0.0b41.0.11.0.21.0.31.1.01.1.11.1.21.1.31.1.41.1.51.1.61.2.01.2.11.2.101.2.111.2.21.2.31.2.41.2.51.2.61.2.71.2.81.2.91.3.01.3.11.3.101.3.21.3.31.3.41.3.51.3.61.3.71.3.81.3.91.4.01.4.11.4.101.4.21.4.31.4.41.4.51.4.71.4.81.4.9
1.6.10
nautobot
PyPI
 2.0.0 up to 2.1.2, before 1.6.10, plus listed versions
1.0.01.0.0a11.0.0a21.0.0b11.0.0b2
Show 45 moreShow less
1.0.0b31.0.0b41.0.11.0.21.0.31.1.01.1.11.1.21.1.31.1.41.1.51.1.61.2.01.2.11.2.101.2.111.2.21.2.31.2.41.2.51.2.61.2.71.2.81.2.91.3.01.3.11.3.101.3.21.3.31.3.41.3.51.3.61.3.71.3.81.3.91.4.01.4.11.4.101.4.21.4.31.4.41.4.51.4.71.4.81.4.9
2.1.21.6.10

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-23345 is a high vulnerability (CVSS 7.1) in Nautobot, published January 22, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.43%, the 37th percentile. Fixed in nautobot 2.1.2.

References

Show 4 moreShow less
This page doesn't list everything

Left out here: 79 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open