pypi

nautobot

36 Total advisories

36 Vulnerabilities

0 Malware

Dependency scanning

Check whether nautobot is in your codebase

Corgea flags malicious and compromised dependencies with reachability analysis, so you fix the packages that actually run in your application instead of working through the whole lockfile.

nautobot

Vulnerabilities

Nautobot: Authorization bypass in approval workflow REST API allows self-approval and unauthorized activation of scheduled jobs

Nautobot: Stored cross-site scripting (XSS) in object create/edit form help text

Nautobot's BANNER_* configuration can be used to inject arbitrary HTML content into Nautobot pages

nautobot has reflected Cross-site Scripting potential in all object list views

Unauthenticated views may expose information to anonymous users

XSS potential in rendered Markdown fields (comments, description, notes, etc.)

Unauthenticated db-file-storage views

Nautobot vulnerable to exposure of hashed user passwords via REST API

Nautobot: Management of users via REST API does not apply configured password validators

Nautobot: GitRepository.current_head field should not be writable through REST API

Nautobot: Webhook definitions could be used for server-side request forgery (SSRF)

Nautobot: REST API permits creation of GenericForeignKey references to objects that the user should not be able to reference

Nautobot: Object bulk rename UI actions vulnerable to denial of service by crafted regular expression (REDoS)

CVE-2026-44798

CVE-2026-44797

CVE-2026-44796

CVE-2026-34203

CVE-2026-44794

Nautobot may allows uploaded media files to be accessible without authentication

Nautobot's BANNER_* configuration can be used to inject arbitrary HTML content into Nautobot pages

Nautobot may allows uploaded media files to be accessible without authentication

Unauthenticated views may expose information to anonymous users

nautobot has reflected Cross-site Scripting potential in all object list views

CVE-2024-36112

Nautobot dynamic-group-members doesn't enforce permission restrictions on member objects

CVE-2025-49142

Nautobot vulnerable to secrets exposure and data manipulation through Jinja2 templating

Nautobot missing object-level permissions enforcement when running Job Buttons

CVE-2023-50263

CVE-2023-51649

Cross-site Scripting potential in custom links, job buttons, and computed fields

CVE-2023-48705

Nautobot vulnerable to remote code execution via Jinja2 template rendering

CVE-2024-23345

CVE-2023-46128

CVE-2023-25657

Browse more PyPI advisories

Start Securing