CVE-2024-34707 Nautobot's BANNER_* configuration can be used to inject arbitrary HTML content into Nautobot pages
An admin can inject arbitrary HTML into Nautobot banners, enabling stored XSS attacks against other users.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-34707?
CVE-2024-34707 is a high-severity cross-site scripting vulnerability in nautobot, published on 13 May 2024. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
Nautobot is a Network Source of Truth and Network Automation Platform. A Nautobot user with admin privileges can modify the `BANNER_TOP`, `BANNER_BOTTOM`, and `BANNER_LOGIN` configuration settings via the `/admin/constance/config/` endpoint. Normally these settings are used to provide custom banner text at the top and bottom of all Nautobot web pages (or specifically on the login page in the case of `BANNER_LOGIN`) but it was reported that an admin user can make use of these settings to inject arbitrary HTML, potentially exposing Nautobot users to security issues such as cross-site scripting (stored XSS). The vulnerability is fixed in Nautobot 1.6.22 and 2.2.4.
Weakness: CWE-79
Which versions are affected by CVE-2024-34707?
5 open source packages ship an affected version, including nautobot. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
nautobot PyPI | All versions | 1.6.22, 2.2.4 |
nautobot PyPI | All versions | 1.6.22 |
nautobot PyPI | All versions | 1.6.22 |
nautobot PyPI | From 2.0.0 | 2.2.4 |
nautobot PyPI | From 2.0.0 | 2.2.4 |
Products include Networktocode Nautobot.
How do I fix CVE-2024-34707?
Upgrade nautobot to a fixed version for your release line: 1.6.22 or 2.2.4.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2024-34707 being exploited?
There is no known exploitation of CVE-2024-34707 in the wild and no public exploit code.
Other vulnerabilities in nautobot
- CVE-2026-44797 Nautobot: Webhook definitions could be used for server-side request forgery (SSRF)
- CVE-2024-32979 Reflected Cross-site Scripting potential in all object list views in Nautobot
- CVE-2023-25657 Remote code execution in Jinja2 template rendering in Nautobot
- CVE-2026-44798 Nautobot: GitRepository.current_head field should not be writable through REST API
- CVE-2024-23345 Nautobot has XSS potential in rendered Markdown fields
Sources
Also known as GHSA-r2hr-4v48-fjv3, PYSEC-2026-1688.