Nautobot EUVD-2026-84814

Exploitation requires an authenticated Nautobot account holding one of the specific object-level permissions: extras.add_relationship or extras.change_relationship (to inject via a Relationship description), or dcim.add_modulefamily or dcim.change_modulefamily (to inject via a Module Family name). The payload is stored, then only triggers when another user - ideally a higher-privileged admin or superuser - opens an affected create or edit form where the value is rendered as form help_text through render_field.html with Django's |safe filter. Limiting factors: attacker must already be an authorized user with these write permissions (PR:L), a privileged victim must interact by viewing the relevant form (UI:R), and it only affects versions prior to 2.4.37 and 3.1.8. Impact is browser-context (session/token theft, actions-as-victim) rather than direct server compromise.

This is a genuine but moderate-priority issue, not a critical remote-code-execution flaw. The CVSS 3.1 base score is 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), which correctly captures a stored XSS: network vector but gated behind authentication (PR:L) and requiring victim interaction (UI:R). No EPSS score, no CISA KEV listing, and no public exploit code are provided in the input - so exploitation status is 'no public exploit identified at time of analysis.' The SSVC framework is not supplied. The vector's scope change (S:C) and the description's emphasis on 'further privilege escalation' and 'session or token theft' are the aggravating factors: because the payload executes in the browser of any user who opens the affected create/edit form - explicitly including administrators and superusers - a low-privileged but authorized attacker can pivot to full account takeover. That escalation path is what makes it more than a self-XSS. Balancing signals: high theoretical impact (superuser compromise) but meaningful preconditions (specific model-level permissions plus a privileged victim viewing the crafted object), no evidence of real-world exploitation, and a confirmed vendor patch. This warrants prompt patching for internet-exposed or multi-tenant Nautobot instances but is not an emergency for isolated deployments.

A user who has been granted extras.add_relationship/change_relationship (or dcim.add_modulefamily/change_modulefamily) permissions stores a payload such as <script>alert('XSS')</script> in a Relationship description or Module Family name. When an administrator or superuser later opens a create/edit form that renders that value as form field help_text via render_field.html and Django's |safe filter, the script executes in the admin's authenticated session. No public exploit code is identified, but the fix's regression tests demonstrate the exact <script> payload, making reproduction trivial for an authorized user.