CVE-2025-49142 json
Nautobot vulnerable to secrets exposure and data manipulation through Jinja2 templating
published 2025-06-10 16 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-17714 , GHSA-wjw6-95h5-4jpx , PYSEC-2025-74 , PYSEC-2025-79
- cvss
- 7.1
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 32%
- public exploits
- 0
- none known
Summary
Nautobot is a Network Source of Truth and Network Automation Platform. All users of Nautobot versions prior to 2.4.10 or prior to 1.6.32 are potentially affected. Due to insufficient security configuration of the Jinja2 templating feature used in computed fields, custom links, etc. in Nautobot, a malicious user could configure this feature set in ways that could expose the value of Secrets defined in Nautobot when the templated content is rendered or that could call Python APIs to modify data within Nautobot when the templated content is rendered, bypassing the object permissions assigned to the viewing user. Nautobot versions 1.6.32 and 2.4.10 will include fixes for the vulnerability. The vulnerability can be partially mitigated by configuring object permissions appropriately to limit certain actions to only trusted users.
Patch / fix
- pypi nautobot 1.6.32, 2.4.10
- networktocode nautobot 1.6.32, 2.4.10
- github.com/nautobot/nautobot#7417 pull request
- github.com/nautobot/nautobot#7429 pull request
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 16 mo ago
Exploit prediction
0.39% chance of exploitation in the next 30 days, higher than 32% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 6.0 | CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:L/SI:L/SA:L |
| CNA | 4.0 | 6.0 | CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 7.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N |
| OSV | 3.1 | 7.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | nautobot | <1.6.32 >=2.0.0, <2.4.10 |
1.6.32 2.4.10 |
Affected products
- nautobot nautobot
Classification
- Weakness
-
- CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine
References
-
github.com
/nautobot/nautobot/pull/7417
web, patch
-
github.com
/nautobot/nautobot/pull/7429
web, patch
-
github.com
/nautobot/nautobot/security/advisories/GHSA-wjw6-95h5-4jpx
web, vendor-advisory, advisory
-
docs.djangoproject.com
/en/4.2/ref/templates/api/#alters-data-description
web, product
-
jinja.palletsprojects.com
/en/stable/sandbox
web, product
-
nvd.nist.gov
/vuln/detail/CVE-2025-49142
advisory
-
github.com
/nautobot/nautobot
package
-
github.com
/pypa/advisory-database/tree/main/vulns/jinja2/PYSEC-2025-74.yaml
web
-
github.com
/pypa/advisory-database/tree/main/vulns/nautobot/PYSEC-2025-79.yaml
web
Sources
- CVE List CVE-2025-49142
- GitHub Advisory GHSA-wjw6-95h5-4jpx
- NVD CVE-2025-49142
- OSV PYSEC-2025-74
- OSV PYSEC-2025-79
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.