What is the CVSS score of CVE-2025-49142?

CVE-2025-49142 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.1%.

Which versions of Python are affected by CVE-2025-49142?

Nautobot users on versions prior to 2.4.10 or 1.6.32 face a critical risk where malicious insiders could expose sensitive credentials (secrets) or manipulate network data without proper…. A patch is available.

How to fix or mitigate CVE-2025-49142?

Within 24 hours: Identify all Nautobot instances and their current versions in your environment. Within 7 days: Apply vendor patches to upgrade affected systems to version 2.4.10 or 1.6.32 or later. Within 30 days: Conduct a security audit of Jinja2 templating configurations in computed fields and custom links to identify any potentially malicious templates; review access logs for unauthorized data access or modifications by privileged users.

Python CVE-2025-49142

EUVD-2025-17714 HIGH

Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)

2025-06-10 security-advisories@github.com

GHSA-wjw6-95h5-4jpx

Python Authentication Bypass Nautobot

7.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 19:49 euvd

EUVD-2025-17714

Analysis Generated

Mar 14, 2026 - 19:49 vuln.today

Patch released

Mar 14, 2026 - 19:49 nvd

Patch available

CVE Published

Jun 10, 2025 - 16:15 nvd

HIGH 7.1

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 pypi packages depend on nautobot (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 2.0.0.

DescriptionGitHub Advisory

Nautobot is a Network Source of Truth and Network Automation Platform. All users of Nautobot versions prior to 2.4.10 or prior to 1.6.32 are potentially affected. Due to insufficient security configuration of the Jinja2 templating feature used in computed fields, custom links, etc. in Nautobot, a malicious user could configure this feature set in ways that could expose the value of Secrets defined in Nautobot when the templated content is rendered or that could call Python APIs to modify data within Nautobot when the templated content is rendered, bypassing the object permissions assigned to the viewing user. Nautobot versions 1.6.32 and 2.4.10 will include fixes for the vulnerability. The vulnerability can be partially mitigated by configuring object permissions appropriately to limit certain actions to only trusted users.