p PatchFirst

PatchFirst · Latest vulnerabilities

netbox-data-flows vulnerabilities

Vulnerabilities published for netbox-data-flows in the last 30 days: 0. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerability: 1

  1. GHSA-v7qw-hx66-4w9x

    High · CVSS 8.7Fix available

    netbox-data-flows has stored XSS in ObjectAlias names rendered inside DataFlow tables

    ### Summary An authenticated user who can create or edit `ObjectAlias` objects can store arbitrary HTML/JavaScript in an alias name. That payload is later rendered unescaped in `DataFlow` table views, causing a stored XSS when another user views the affected page. ### Details The issue is caused by unsafe HTML generation in the plugin’s custom table column renderer. Relevant code on `main` (`bf96eac`, same commit as `origin/main` at the time of review): - `netbox_data_flows/models/objectaliases.py` - `ObjectAlias.name` is user-controlled (`CharField`) - `ObjectAlias.__str__()` returns `self.name` directly - `netbox_data_flows/tables/da

    netbox-data-flowsPython
    • Update to 1.5.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →