CVE-2025-49142 json
Nautobot vulnerable to secrets exposure and data manipulation through Jinja2 templating
published last yr. modified 4mo ago also EUVD-2025-17714 , GHSA-wjw6-95h5-4jpx , PYSEC-2025-74 , PYSEC-2025-79
- cvss
- 7.1
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 32%
- public exploits
- 0
- none known
Summary
Nautobot is a Network Source of Truth and Network Automation Platform. All users of Nautobot versions prior to 2.4.10 or prior to 1.6.32 are potentially affected. Due to insufficient security configuration of the Jinja2 templating feature used in computed fields, custom links, etc. in Nautobot, a malicious user could configure this feature set in ways that could expose the value of Secrets defined in Nautobot when the templated content is rendered or that could call Python APIs to modify data within Nautobot when the templated content is rendered, bypassing the object permissions assigned to the viewing user. Nautobot versions 1.6.32 and 2.4.10 will include fixes for the vulnerability. The vulnerability can be partially mitigated by configuring object permissions appropriately to limit certain actions to only trusted users.
Patch / fix
- pypi nautobot 1.6.32, 2.4.10
- networktocode nautobot 1.6.32, 2.4.10
- github.com/nautobot/nautobot#7417 pull request
- github.com/nautobot/nautobot#7429 pull request
Is CVE-2025-49142 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- last yr.
Exploit prediction
0.39% chance of exploitation in the next 30 days, higher than 32% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 6.0 | CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:L/SI:L/SA:L |
| CNA | 4.0 | 6.0 | CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 7.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N |
| OSV | 3.1 | 7.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | nautobot | <1.6.32 >=2.0.0, <2.4.10 |
1.6.32 2.4.10 |
Affected products
- nautobot nautobot
Classification
- Weakness
-
- CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine
References
-
github.com
/nautobot/nautobot/pull/7417
web, patch
-
github.com
/nautobot/nautobot/pull/7429
web, patch
-
github.com
/nautobot/nautobot/security/advisories/GHSA-wjw6-95h5-4jpx
web, vendor-advisory, advisory
-
docs.djangoproject.com
/en/4.2/ref/templates/api/#alters-data-description
web, product
-
jinja.palletsprojects.com
/en/stable/sandbox
web, product
-
nvd.nist.gov
/vuln/detail/CVE-2025-49142
advisory
-
github.com
/nautobot/nautobot
package
-
github.com
/pypa/advisory-database/tree/main/vulns/jinja2/PYSEC-2025-74.yaml
web
-
github.com
/pypa/advisory-database/tree/main/vulns/nautobot/PYSEC-2025-79.yaml
web
Sources
- CVE List CVE-2025-49142
- GitHub Advisory GHSA-wjw6-95h5-4jpx
- NVD CVE-2025-49142
- OSV PYSEC-2025-74
- OSV PYSEC-2025-79
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.