GHSA-v7qw-hx66-4w9x

GHSA-v7qw-hx66-4w9x · netbox-data-flows has stored XSS in ObjectAlias names rendered inside DataFlow tables

This page contains facts from public vulnerability sources. Check the original advisory before updating.

### Summary An authenticated user who can create or edit `ObjectAlias` objects can store arbitrary HTML/JavaScript in an alias name. That payload is later rendered unescaped in `DataFlow` table views, causing a stored XSS when another user views the affected page. ### Details The issue is caused by unsafe HTML generation in the plugin’s custom table column renderer. Relevant code on `main` (`bf96eac`, same commit as `origin/main` at the time of review): - `netbox_data_flows/models/objectaliases.py` - `ObjectAlias.name` is user-controlled (`CharField`) - `ObjectAlias.__str__()` returns `self.name` directly - `netbox_data_flows/tables/dataflows.py` - `DataFlowTable.sources` and `DataFlowTable.destinations` use `ObjectAliasListColumn` - `netbox_data_flows/tables/columns.py` - `ObjectAliasListColumn.render()` calls `object_list_to_string(value.all(), linkify=True)` - `netbox_data_flows/utils/helpers.py` - `object_list_to_string()` builds raw anchor tags with: ```python mark_safe(separator.join(f'<a href="{o.get_absolute_url()}">{o}</a>' for o in objects)) ``` The alias text (`{o}`) is inserted into HTML without escaping, then the whole string is marked safe. Because `ObjectAlias.__str__()` returns the user-supplied name, HTML/JS in the alias name is executed in the victim’s browser. This affects any page rendering `DataFlowTable`, including at least: - the main Data Flow list page - model tabs that reuse `DataFlowTable` ### PoC Environment: - NetBox with `netbox-data-flows` installed - No special plugin configuration required Steps: 1. Log in as a user with permission to create or edit `ObjectAlias` and `DataFlow`. 2. Create a new `ObjectAlias` with the following name: ```html <img src=x onerror=alert(document.domain)> ``` 3. Create or edit a `DataFlow` so this alias is present in either `sources` or `destinations`. 4. Log in as another user and open the Data Flow list page in the plugin UI. 5. The JavaScript executes when the table renders the alias list. A simple path to trigger is the Data Flow list page. Any other page that renders `DataFlowTable` should also be tested. ### Impact This is a stored cross-site scripting vulnerability. Impacted users: - any authenticated user who can view a page rendering the affected `DataFlow` table - especially higher-privileged NetBox users, because an attacker with lower privileges may target them by planting a malicious alias name Possible impact: - session theft - execution of privileged actions in the victim’s session - exfiltration of data visible to the victim in NetBox

CVSS 8.7 · High · Fix available

Published

2026-05-07T22:31:32Z

Updated

2026-05-07T22:48:01.017152Z

Stack: python

Check your server →