Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

PyPI package

netbox-data-flows

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.7PyPIAmendedPublished

    netbox-data-flows has stored XSS in ObjectAlias names rendered inside DataFlow tables

    GHSA-v7qw-hx66-4w9x

    Affected
    • PyPI netbox-data-flows <= 1.5.0
    Fixed in
    1.5.1· Vendor fix available
    Issue
    An authenticated user who can create or edit ObjectAlias objects can store arbitrary HTML/JavaScript in an alias name. That payload is later rendered unescaped in DataFlow table views, causing a stored XSS when another user views the affected page. Details The issue is caused by unsafe HTML generation in the plugin’s custom table column renderer. Relevant code on main (bf96eac, same commit as origin/main at the time of review): - netboxdataflows/models/objectaliases.py - ObjectAlias.name is user-controlled (CharField) - ObjectAlias.str() returns self.name directly - netboxdataflows/tables/dataflows.py - DataFlowTable.sources and DataFlowTable.destinations use ObjectAliasListColumn - netboxdataflows/tables/columns.py - ObjectAliasListColumn.render() calls objectlisttostring(value.all(), linkify=True) - netboxdataflows/utils/helpers.py - objectlisttostring() builds raw anchor tags with: The alias text ({o}) is inserted into HTML without escaping, then the whole string is marked…

    Recommended action: Upgrade to 1.5.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →