Nautobot allows a user with extras.add_relationship or extras.change_relationship permission to store arbitrary HTML or JavaScript in a Relationship description, and a user with dcim.add_modulefamily or dcim.change_modulefamily permission to store it in a Module Family name. These values are rendered by Django's |safe filter without proper neutralization, so the stored content executes within the authenticated browser session of any user who opens the affected create or edit form, including administrators and superusers. The attack can lead to session or token theft, arbitrary code execution, and further privilege escalation.

Nautobot before version 2.4.37 and before 3.1.8 is affected. The vulnerability is present in all releases older than those indicated by the Nautobot maintainers.

The CVSS score of 5.4 indicates a moderate severity. Because exploitation requires an authenticated user, a credential compromise or an insider with the relevant permissions can leverage the flaw. No EPSS data is available, and the issue is not listed in CISA KEV, suggesting limited known exploitation at the time of reporting.