{"id":"CVE-2024-34707","aliases":["EUVD-2024-1758","GHSA-r2hr-4v48-fjv3","PYSEC-2026-1688"],"status":"published","title":"Nautobot's BANNER_* configuration can be used to inject arbitrary HTML content into Nautobot pages","description":"Nautobot is a Network Source of Truth and Network Automation Platform. A Nautobot user with admin privileges can modify the `BANNER_TOP`, `BANNER_BOTTOM`, and `BANNER_LOGIN` configuration settings via the `/admin/constance/config/` endpoint. Normally these settings are used to provide custom banner text at the top and bottom of all Nautobot web pages (or specifically on the login page in the case of `BANNER_LOGIN`) but it was reported that an admin user can make use of these settings to inject arbitrary HTML, potentially exposing Nautobot users to security issues such as cross-site scripting (stored XSS). The vulnerability is fixed in Nautobot 1.6.22 and 2.2.4.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:H/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00606,"percentile":0.49341,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2024-05-13T19:22:41Z","modified":"2026-10-28T02:31:04Z","fixes":[{"ecosystem":"PyPI","package":"nautobot","fixed_in":["1.6.22","2.2.4"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"nautobot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.22"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"nautobot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.2.4"}]}]},{"source":"osv","ecosystem":"PyPI","package":"nautobot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.22"}]}],"versions":["1.0.0","1.0.0a1","1.0.0a2","1.0.0b1","1.0.0b2","1.0.0b3","1.0.0b4","1.0.1","1.0.2","1.0.3","1.1.0","1.1.1","1.1.2","1.1.3","1.1.4","1.1.5","1.1.6","1.2.0","1.2.1","1.2.10","1.2.11","1.2.2","1.2.3","1.2.4","1.2.5","1.2.6","1.2.7","1.2.8","1.2.9","1.3.0","1.3.1","1.3.10","1.3.2","1.3.3","1.3.4","1.3.5","1.3.6","1.3.7","1.3.8","1.3.9","1.4.0","1.4.1","1.4.10","1.4.2","1.4.3","1.4.4","1.4.5","1.4.7","1.4.8","1.4.9","1.5.0","1.5.1","1.5.10","1.5.11","1.5.12","1.5.13","1.5.14","1.5.15","1.5.16","1.5.17","1.5.18","1.5.19","1.5.2","1.5.20","1.5.21","1.5.22","1.5.23","1.5.24","1.5.3","1.5.4","1.5.5","1.5.6","1.5.7","1.5.8","1.5.9","1.6.0","1.6.1","1.6.10","1.6.11","1.6.12","1.6.13","1.6.14","1.6.15","1.6.16","1.6.17","1.6.18","1.6.19","1.6.2","1.6.20","1.6.21","1.6.3","1.6.4","1.6.5","1.6.6","1.6.7","1.6.8","1.6.9"]},{"source":"osv","ecosystem":"PyPI","package":"nautobot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.2.4"}]}],"versions":["2.0.0","2.0.1","2.0.2","2.0.3","2.0.4","2.0.5","2.0.6","2.1.0","2.1.0b1","2.1.1","2.1.2","2.1.3","2.1.4","2.1.5","2.1.6","2.1.7","2.1.8","2.1.9","2.2.0","2.2.0b1","2.2.1","2.2.2","2.2.3"]},{"source":"osv","ecosystem":"PyPI","package":"nautobot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.22"},{"introduced":"2.0.0"},{"fixed":"2.2.4"}]}],"versions":["1.0.0","1.0.0a1","1.0.0a2","1.0.0b1","1.0.0b2","1.0.0b3","1.0.0b4","1.0.1","1.0.2","1.0.3","1.1.0","1.1.1","1.1.2","1.1.3","1.1.4","1.1.5","1.1.6","1.2.0","1.2.1","1.2.10","1.2.11","1.2.2","1.2.3","1.2.4","1.2.5","1.2.6","1.2.7","1.2.8","1.2.9","1.3.0","1.3.1","1.3.10","1.3.2","1.3.3","1.3.4","1.3.5","1.3.6","1.3.7","1.3.8","1.3.9","1.4.0","1.4.1","1.4.10","1.4.2","1.4.3","1.4.4","1.4.5","1.4.7","1.4.8","1.4.9","1.5.0","1.5.1","1.5.10","1.5.11","1.5.12","1.5.13","1.5.14","1.5.15","1.5.16","1.5.17","1.5.18","1.5.19","1.5.2","1.5.20","1.5.21","1.5.22","1.5.23","1.5.24","1.5.3","1.5.4","1.5.5","1.5.6","1.5.7","1.5.8","1.5.9","1.6.0","1.6.1","1.6.10","1.6.11","1.6.12","1.6.13","1.6.14","1.6.15","1.6.16","1.6.17","1.6.18","1.6.19","1.6.2","1.6.20","1.6.21","1.6.3","1.6.4","1.6.5","1.6.6","1.6.7","1.6.8","1.6.9","2.0.0","2.0.1","2.0.2","2.0.3","2.0.4","2.0.5","2.0.6","2.1.0","2.1.0b1","2.1.1","2.1.2","2.1.3","2.1.4","2.1.5","2.1.6","2.1.7","2.1.8","2.1.9","2.2.0","2.2.0b1","2.2.1","2.2.2","2.2.3"]}],"products":[{"vendor":"nautobot","product":"nautobot"},{"vendor":"networktocode","product":"nautobot"}],"references":[{"url":"https://github.com/nautobot/nautobot/security/advisories/GHSA-r2hr-4v48-fjv3","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","advisory","web"]},{"url":"https://github.com/nautobot/nautobot/pull/5697","tags":["x_refsource_MISC","x_transferred","Exploit","Patch","fix","web"]},{"url":"https://github.com/nautobot/nautobot/pull/5698","tags":["x_refsource_MISC","x_transferred","Exploit","Patch","fix","web"]},{"url":"https://github.com/nautobot/nautobot/commit/4f0a66bd6307bfe0e0acb899233e0d4ad516f51c","tags":["x_refsource_MISC","x_transferred","Patch","fix","web"]},{"url":"https://github.com/nautobot/nautobot/commit/f640aedc69c848d3d1be57f0300fc40033ff6423","tags":["x_refsource_MISC","x_transferred","Patch","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-34707","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-r2hr-4v48-fjv3","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/34xxx/CVE-2024-34707.json","tags":["advisory"]},{"url":"https://github.com/nautobot/nautobot","tags":["package"]},{"url":"https://pypi.org/project/nautobot","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-34707","title":"Nautobot's BANNER_* configuration can be used to inject arbitrary HTML content into Nautobot pages","description":"Nautobot is a Network Source of Truth and Network Automation Platform. A Nautobot user with admin privileges can modify the `BANNER_TOP`, `BANNER_BOTTOM`, and `BANNER_LOGIN` configuration settings via the `/admin/constance/config/` endpoint. Normally these settings are used to provide custom banner text at the top and bottom of all Nautobot web pages (or specifically on the login page in the case of `BANNER_LOGIN`) but it was reported that an admin user can make use of these settings to inject arbitrary HTML, potentially exposing Nautobot users to security issues such as cross-site scripting (stored XSS). The vulnerability is fixed in Nautobot 1.6.22 and 2.2.4.","status":"published","published":"2024-05-13T19:22:41.202Z","modified":"2024-08-02T02:59:22.584Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:H/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:34:23.516065Z"}],"euvd":[{"id":"EUVD-2024-1758","description":"Nautobot is a Network Source of Truth and Network Automation Platform. A Nautobot user with admin privileges can modify the `BANNER_TOP`, `BANNER_BOTTOM`, and `BANNER_LOGIN` configuration settings via the `/admin/constance/config/` endpoint. Normally these settings are used to provide custom banner text at the top and bottom of all Nautobot web pages (or specifically on the login page in the case of `BANNER_LOGIN`) but it was reported that an admin user can make use of these settings to inject arbitrary HTML, potentially exposing Nautobot users to security issues such as cross-site scripting (stored XSS). The vulnerability is fixed in Nautobot 1.6.22 and 2.2.4.","status":"published","published":"2024-05-13T19:22:41Z","modified":"2024-08-02T02:59:22Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:H/A:L","level":"high"}],"updated_at":"2026-11-03T03:50:20.898281Z"}],"ghsa":[{"id":"GHSA-r2hr-4v48-fjv3","title":"Nautobot's BANNER_* configuration can be used to inject arbitrary HTML content into Nautobot pages","description":"### Impact\n\nA Nautobot user with admin privileges can modify the `BANNER_TOP`, `BANNER_BOTTOM`, and `BANNER_LOGIN` configuration settings via the `/admin/constance/config/` endpoint. Normally these settings are used to provide custom banner text at the top and bottom of all Nautobot web pages (or specifically on the login page in the case of `BANNER_LOGIN`) but it was reported that an admin user can make use of these settings to inject arbitrary HTML, potentially exposing Nautobot users to security issues such as cross-site scripting (stored XSS).\n\n### Patches\n_Has the problem been patched? What versions should users upgrade to?_\n\nPatches will be released as part of Nautobot 1.6.22 and 2.2.4.\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\n\nAs [described in the Nautobot documentation](https://docs.nautobot.com/projects/core/en/stable/user-guide/administration/configuration/optional-settings/#administratively-configurable-settings), these settings are only configurable through the admin UI of Nautobot if they are *not* explicitly set to some non-empty value in the `nautobot_config.py` or equivalent Nautobot configuration file. Therefore, adding the following configuration to said file completely mitigates this vulnerability in both Nautobot 1.x and 2.x:\n\n```python\nBANNER_LOGIN = \" \"\nBANNER_TOP = \" \"\nBANNER_BOTTOM = \" \"\n```\n\nor alternately (Nautobot 2.x only), if those variables are not defined explicitly in your configuration file, setting the following environment variables for the Nautobot user account serves the same purpose:\n\n```shell\nNAUTOBOT_BANNER_LOGIN=\" \"\nNAUTOBOT_BANNER_TOP=\" \"\nNAUTOBOT_BANNER_BOTTOM=\" \"\n```\n\nLimiting all users who do not need elevated privileges to non-admin access (`is_superuser: False` and `is_staff: False`) is a partial mitigation as well.\n\n\n### References\n\n- https://github.com/nautobot/nautobot/pull/5697\n- https://github.com/nautobot/nautobot/pull/5698","status":"published","published":"2024-05-13T19:59:26Z","modified":"2024-05-14T20:04:16Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:H/A:L","level":"high"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:37:48.848211Z"}],"nvd":[{"id":"CVE-2024-34707","description":"Nautobot is a Network Source of Truth and Network Automation Platform. A Nautobot user with admin privileges can modify the `BANNER_TOP`, `BANNER_BOTTOM`, and `BANNER_LOGIN` configuration settings via the `/admin/constance/config/` endpoint. Normally these settings are used to provide custom banner text at the top and bottom of all Nautobot web pages (or specifically on the login page in the case of `BANNER_LOGIN`) but it was reported that an admin user can make use of these settings to inject arbitrary HTML, potentially exposing Nautobot users to security issues such as cross-site scripting (stored XSS). The vulnerability is fixed in Nautobot 1.6.22 and 2.2.4.","status":"published","published":"2024-05-14T15:39:30.633Z","modified":"2026-06-17T07:33:54.84Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:H/A:L","level":"high","assessor":"secondary"},{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:09:58.124007Z"}],"osv":[{"id":"CVE-2024-34707","title":"Nautobot's BANNER_* configuration can be used to inject arbitrary HTML content into Nautobot pages","description":"Nautobot is a Network Source of Truth and Network Automation Platform. A Nautobot user with admin privileges can modify the `BANNER_TOP`, `BANNER_BOTTOM`, and `BANNER_LOGIN` configuration settings via the `/admin/constance/config/` endpoint. Normally these settings are used to provide custom banner text at the top and bottom of all Nautobot web pages (or specifically on the login page in the case of `BANNER_LOGIN`) but it was reported that an admin user can make use of these settings to inject arbitrary HTML, potentially exposing Nautobot users to security issues such as cross-site scripting (stored XSS). The vulnerability is fixed in Nautobot 1.6.22 and 2.2.4.","status":"published","published":"2024-05-13T19:22:41.202Z","modified":"2026-10-28T02:31:04.039339701Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:H/A:L","level":"high"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:44:40.391953Z"},{"id":"GHSA-r2hr-4v48-fjv3","title":"Nautobot's BANNER_* configuration can be used to inject arbitrary HTML content into Nautobot pages","description":"### Impact\n\nA Nautobot user with admin privileges can modify the `BANNER_TOP`, `BANNER_BOTTOM`, and `BANNER_LOGIN` configuration settings via the `/admin/constance/config/` endpoint. Normally these settings are used to provide custom banner text at the top and bottom of all Nautobot web pages (or specifically on the login page in the case of `BANNER_LOGIN`) but it was reported that an admin user can make use of these settings to inject arbitrary HTML, potentially exposing Nautobot users to security issues such as cross-site scripting (stored XSS).\n\n### Patches\n_Has the problem been patched? What versions should users upgrade to?_\n\nPatches will be released as part of Nautobot 1.6.22 and 2.2.4.\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\n\nAs [described in the Nautobot documentation](https://docs.nautobot.com/projects/core/en/stable/user-guide/administration/configuration/optional-settings/#administratively-configurable-settings), these settings are only configurable through the admin UI of Nautobot if they are *not* explicitly set to some non-empty value in the `nautobot_config.py` or equivalent Nautobot configuration file. Therefore, adding the following configuration to said file completely mitigates this vulnerability in both Nautobot 1.x and 2.x:\n\n```python\nBANNER_LOGIN = \" \"\nBANNER_TOP = \" \"\nBANNER_BOTTOM = \" \"\n```\n\nor alternately (Nautobot 2.x only), if those variables are not defined explicitly in your configuration file, setting the following environment variables for the Nautobot user account serves the same purpose:\n\n```shell\nNAUTOBOT_BANNER_LOGIN=\" \"\nNAUTOBOT_BANNER_TOP=\" \"\nNAUTOBOT_BANNER_BOTTOM=\" \"\n```\n\nLimiting all users who do not need elevated privileges to non-admin access (`is_superuser: False` and `is_staff: False`) is a partial mitigation as well.\n\n\n### References\n\n- https://github.com/nautobot/nautobot/pull/5697\n- https://github.com/nautobot/nautobot/pull/5698","status":"published","published":"2024-05-13T19:59:26Z","modified":"2026-09-10T03:50:14.214530149Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:H/A:L","level":"high"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:55.122811Z"},{"id":"PYSEC-2026-1688","title":"Nautobot's BANNER_* configuration can be used to inject arbitrary HTML content into Nautobot pages","description":"### Impact\n\nA Nautobot user with admin privileges can modify the `BANNER_TOP`, `BANNER_BOTTOM`, and `BANNER_LOGIN` configuration settings via the `/admin/constance/config/` endpoint. Normally these settings are used to provide custom banner text at the top and bottom of all Nautobot web pages (or specifically on the login page in the case of `BANNER_LOGIN`) but it was reported that an admin user can make use of these settings to inject arbitrary HTML, potentially exposing Nautobot users to security issues such as cross-site scripting (stored XSS).\n\n### Patches\n_Has the problem been patched? What versions should users upgrade to?_\n\nPatches will be released as part of Nautobot 1.6.22 and 2.2.4.\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\n\nAs [described in the Nautobot documentation](https://docs.nautobot.com/projects/core/en/stable/user-guide/administration/configuration/optional-settings/#administratively-configurable-settings), these settings are only configurable through the admin UI of Nautobot if they are *not* explicitly set to some non-empty value in the `nautobot_config.py` or equivalent Nautobot configuration file. Therefore, adding the following configuration to said file completely mitigates this vulnerability in both Nautobot 1.x and 2.x:\n\n```python\nBANNER_LOGIN = \" \"\nBANNER_TOP = \" \"\nBANNER_BOTTOM = \" \"\n```\n\nor alternately (Nautobot 2.x only), if those variables are not defined explicitly in your configuration file, setting the following environment variables for the Nautobot user account serves the same purpose:\n\n```shell\nNAUTOBOT_BANNER_LOGIN=\" \"\nNAUTOBOT_BANNER_TOP=\" \"\nNAUTOBOT_BANNER_BOTTOM=\" \"\n```\n\nLimiting all users who do not need elevated privileges to non-admin access (`is_superuser: False` and `is_staff: False`) is a partial mitigation as well.\n\n\n### References\n\n- https://github.com/nautobot/nautobot/pull/5697\n- https://github.com/nautobot/nautobot/pull/5698","status":"published","published":"2026-07-07T11:45:42.267288Z","modified":"2026-07-07T17:47:07.181680804Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:52:55.06457Z"}]}}