CVE-2025-49142

Nautobot is a Network Source of Truth and Network Automation Platform. All users of Nautobot versions prior to 2.4.10 or prior to 1.6.32 are potentially affected. Due to insufficient security configuration of the Jinja2 templating feature used in computed fields, custom links, etc. in Nautobot, a malicious user could configure this feature set in ways that could expose the value of Secrets defined in Nautobot when the templated content is rendered or that could call Python APIs to modify data within Nautobot when the templated content is rendered, bypassing the object permissions assigned to the viewing user. Nautobot versions 1.6.32 and 2.4.10 will include fixes for the vulnerability. The vulnerability can be partially mitigated by configuring object permissions appropriately to limit certain actions to only trusted users.

• CWE-1336

• https://docs.djangoproject.com/en/4.2/ref/templates/api/#alters-data-descriptionProduct
• https://github.com/nautobot/nautobot/pull/7417Patch
• https://github.com/nautobot/nautobot/pull/7429Patch
• https://github.com/nautobot/nautobot/security/advisories/GHSA-wjw6-95h5-4jpxVendor Advisory
• https://jinja.palletsprojects.com/en/stable/sandboxProduct

Published

Jun 10, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-49137HAX CMS PHP allows users to manage their microsite universe …6.1
• CVE-2025-49138HAX CMS PHP allows users to manage their microsite universe …6.5
• CVE-2025-49139HAX CMS PHP allows users to manage their microsite universe …6.5
• CVE-2025-4914A vulnerability was found in PHPGurukul Auto Taxi Stand Mana…9.8
• CVE-2025-49140Pion Interceptor is a framework for building RTP/RTCP commun…7.5
• CVE-2025-49141HAX CMS PHP allows users to manage their microsite universe …8.8
• CVE-2025-49143Nautobot is a Network Source of Truth and Network Automation…5.9
• CVE-2025-49144Notepad++ is a free and open-source source code editor. In v…7.3
• CVE-2025-49145Combodo iTop is a web based IT service management tool. In v…6.5
• CVE-2025-49146pgjdbc is an open source postgresql JDBC Driver. From 42.7.4…5.9
• CVE-2025-49147Umbraco, a free and open source .NET content management syst…5.3
• CVE-2025-49148ClipShare is a lightweight and cross-platform tool for clipb…7.3