CVE-2025-57543: 
NixOS vulnerability analysis and mitigation

CVE-2025-57543 is an HTML Injection / Cross-Site Scripting (XSS) vulnerability in NetBox version 4.3.5, affecting the "comment" input fields on various object forms. An unauthenticated or low-privileged attacker can inject arbitrary HTML into these fields, which is then rendered in the web UI when viewed by other users, potentially enabling UI redress attacks or phishing-style redirection. The vulnerability was discovered by Mert Turan and published on March 16, 2026. It carries a CVSS v3.1 base score of 6.1 (Medium) (Feedly, GitHub Gist).

The root cause is improper neutralization of user-supplied input during web page generation (CWE-79), specifically in the comment input fields across various NetBox object forms. The vulnerable code paths are identified in netbox/templates/generic/object_comment.html and netbox/views/generic.py, where user-supplied HTML is neither sanitized nor escaped before being rendered in the browser. An attacker submits a malicious payload (e.g., <a href="http://evil.com">Click here</a> or <marquee>Injected Content</marquee>) into a comment field on any NetBox object (device, IP address, etc.); when another user views that object, the HTML is rendered directly in their browser. Exploitation may not require authentication depending on the access control configuration of the specific NetBox deployment (GitHub Gist).

Successful exploitation allows an attacker to inject arbitrary HTML into NetBox's web interface, which is rendered for any user who views the affected object. This can lead to UI manipulation, phishing-style redirection, and user interface redress (clickjacking-style) attacks. While direct JavaScript execution is not confirmed in the base case, the vulnerability can serve as a stepping stone to more severe XSS attacks in certain deployment contexts or when combined with other flaws, with low confidentiality and integrity impact per the CVSS assessment (Feedly, GitHub Gist).

A public proof-of-concept is available via a GitHub Gist published by the discoverer, Mert Turan, demonstrating example payloads (GitHub Gist). The EPSS score is approximately 0.029% (0.000290), indicating a low probability of widespread exploitation in the near term (Feedly). There is no evidence of in-the-wild exploitation, threat actor attribution, or inclusion in the CISA KEV catalog at this time.

1. Reconnaissance: Identify a NetBox 4.3.5 instance (e.g., via Shodan, Censys, or direct access to a known deployment such as demo.netbox.dev). Determine whether the instance allows unauthenticated or low-privileged access to object comment fields.
2. Access a vulnerable form: Navigate to any NetBox object form that includes a "comment" field (e.g., a device, IP address, or prefix object).
3. Inject malicious HTML payload: Enter a crafted HTML payload into the comment field, such as:

   <a href="http://attacker.com">Click here for Important Notice</a>

   or

   <iframe src="http://attacker.com" style="display:none"></iframe>

4. Save the object: Submit the form to persist the injected HTML in the NetBox database.
5. Victim views the object: When another user (e.g., a network administrator) views the object details page, the injected HTML is rendered in their browser, potentially redirecting them to a phishing page or manipulating the UI to deceive them (GitHub Gist).

• Logs: NetBox application logs showing POST requests to object edit/create endpoints (e.g., /dcim/devices/<id>/edit/, /ipam/ip-addresses/<id>/edit/) containing HTML tags (<a, <iframe, <img, <script) in the comments parameter.
• Database: Unexpected HTML markup in the comments column of NetBox database tables (e.g., dcim_device, ipam_ipaddress) — review for entries containing <, >, href=, or src= attributes.
• Network: Outbound HTTP requests from user browsers to unexpected external domains originating from NetBox page loads, potentially indicating successful HTML injection with redirect payloads.
• Web UI: Visible anomalies in NetBox object detail pages such as unexpected links, banners, iframes, or redirects when viewing object comments (GitHub Gist).

The vendor has not yet published an official patch or advisory as of the available information. As an immediate workaround, administrators should restrict write access to NetBox comment fields to trusted users only, and review existing comment fields in the database for injected HTML content. Deploying a Web Application Firewall (WAF) rule to block HTML tags in comment parameters can reduce exposure. Organizations should monitor the official NetBox GitHub repository for a patched release and upgrade as soon as one is available (GitHub Gist, Feedly).