{"id":"PYSEC-2026-1686","summary":"nautobot has reflected Cross-site Scripting potential in all object list views","details":"### Impact\n\nIt was discovered that due to improper handling and escaping of user-provided query parameters, a maliciously crafted Nautobot URL could potentially be used to execute a Reflected Cross-Site Scripting (Reflected XSS) attack against users. All filterable object-list views in Nautobot are vulnerable, including:\n\n- /dcim/location-types/\n- /dcim/locations/\n- /dcim/racks/\n- /dcim/rack-groups/\n- /dcim/rack-reservations/\n- /dcim/rack-elevations/\n- /tenancy/tenants/\n- /tenancy/tenant-groups/\n- /extras/tags/\n- /extras/statuses/\n- /extras/roles/\n- /extras/dynamic-groups/\n- /dcim/devices/\n- /dcim/platforms/\n- /dcim/virtual-chassis/\n- /dcim/device-redundancy-groups/\n- /dcim/interface-redundancy-groups/\n- /dcim/device-types/\n- /dcim/manufacturers/\n- /dcim/cables/\n- /dcim/console-connections/\n- /dcim/power-connections/\n- /dcim/interface-connections/\n- /dcim/interfaces/\n- /dcim/front-ports/\n- /dcim/rear-ports/\n- /dcim/console-ports/\n- /dcim/console-server-ports/\n- /dcim/power-ports/\n- /dcim/power-outlets/\n- /dcim/device-bays/\n- /dcim/inventory-items/\n- /ipam/ip-addresses/\n- /ipam/prefixes\n- /ipam/rirs/\n- /ipam/namespaces/\n- /ipam/vrfs/\n- /ipam/route-targets/\n- /ipam/vlans/\n- /ipam/vlan-groups/\n- /ipam/services/\n- /virtualization/virtual-machines/\n- /virtualization/interfaces/\n- /virtualization/clusters/\n- /virtualization/cluster-types/\n- /virtualization/cluster-groups/\n- /circuits/circuits/\n- /circuits/circuit-types/\n- /circuits/providers/\n- /circuits/provider-networks/\n- /dcim/power-feeds/\n- /dcim/power-panels/\n- /extras/secrets/\n- /extras/secrets-groups/\n- /extras/jobs/\n- /extras/jobs/scheduled-jobs/approval-queue/\n- /extras/jobs/scheduled-jobs/\n- /extras/job-results/\n- /extras/job-hooks/\n- /extras/job-buttons/\n- /extras/object-changes/\n- /extras/git-repositories/\n- /extras/graphql-queries/\n- /extras/relationships/\n- /extras/notes/\n- /extras/config-contexts/\n- /extras/config-context-schemas/\n- /extras/export-templates/\n- /extras/external-integrations/\n- /extras/webhooks/\n- /extras/computed-fields/\n- /extras/custom-fields/\n- /extras/custom-links/\n\nas well as any similar object-list views provided by any Nautobot App.\n\n### Patches\n\nFixed in Nautobot 1.6.20 and 2.2.3.\n\n### Workarounds\n\nNo workaround has been identified\n\n### References\n\n- #5646 \n- #5647\n\n**Credit to [Michael Panorios](mailto:michael.panorios@pwc.com) for reporting this issue.**","aliases":["CVE-2024-32979","GHSA-jxgr-gcj5-cqqg"],"modified":"2026-07-07T17:48:02.310357146Z","published":"2026-07-07T11:45:40.353768Z","references":[{"type":"WEB","url":"https://github.com/nautobot/nautobot/security/advisories/GHSA-jxgr-gcj5-cqqg"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-32979"},{"type":"WEB","url":"https://github.com/nautobot/nautobot/pull/5646"},{"type":"WEB","url":"https://github.com/nautobot/nautobot/pull/5647"},{"type":"WEB","url":"https://github.com/nautobot/nautobot/commit/2ea5797ea43646d5d8b29433e4c707b5a9758146"},{"type":"WEB","url":"https://github.com/nautobot/nautobot/commit/42440ebd9b381534ad89d62420ebea00d703d64e"},{"type":"PACKAGE","url":"https://github.com/nautobot/nautobot"},{"type":"WEB","url":"https://github.com/nautobot/nautobot/releases/tag/v1.6.20"},{"type":"WEB","url":"https://github.com/nautobot/nautobot/releases/tag/v2.2.3"},{"type":"PACKAGE","url":"https://pypi.org/project/nautobot"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-jxgr-gcj5-cqqg"}],"affected":[{"package":{"name":"nautobot","ecosystem":"PyPI","purl":"pkg:pypi/nautobot"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.5.0"},{"fixed":"1.6.20"},{"introduced":"2.0.0"},{"fixed":"2.2.3"}]}],"versions":["1.5.0","1.5.1","1.5.10","1.5.11","1.5.12","1.5.13","1.5.14","1.5.15","1.5.16","1.5.17","1.5.18","1.5.19","1.5.2","1.5.20","1.5.21","1.5.22","1.5.23","1.5.24","1.5.3","1.5.4","1.5.5","1.5.6","1.5.7","1.5.8","1.5.9","1.6.0","1.6.1","1.6.10","1.6.11","1.6.12","1.6.13","1.6.14","1.6.15","1.6.16","1.6.17","1.6.18","1.6.19","1.6.2","1.6.3","1.6.4","1.6.5","1.6.6","1.6.7","1.6.8","1.6.9","2.0.0","2.0.1","2.0.2","2.0.3","2.0.4","2.0.5","2.0.6","2.1.0","2.1.0b1","2.1.1","2.1.2","2.1.3","2.1.4","2.1.5","2.1.6","2.1.7","2.1.8","2.1.9","2.2.0","2.2.0b1","2.2.1","2.2.2"],"database_specific":{"source":"https://github.com/pypa/advisory-database/blob/main/vulns/nautobot/PYSEC-2026-1686.yaml"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:L"}]}