PyPI/nautobot CVE-2023-25657: high 7.5, EPSS 1.53%
Nautobot vulnerable to remote code execution via Jinja2 template rendering
Action: Upgrade nautobot to 1.5.7 or later.
pip install nautobot==1.5.7Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.5.7 | - |
Fixed versions
| 1.5.7 |
Sources
- osv: GHSA-8mfq-f5wj-vw5m
- https://github.com/nautobot/nautobot/security/advisories/GHSA-8mfq-f5wj-vw5m
- https://nvd.nist.gov/vuln/detail/CVE-2023-25657
- https://github.com/nautobot/nautobot/commit/d47f157e83b0c353bb2b697f911882c71cf90ca0
- https://docs.nautobot.com/projects/core/en/stable/release-notes/version-1.5/#v157-2023-01-04
- https://github.com/nautobot/nautobot
- https://github.com/pypa/advisory-database/tree/main/vulns/nautobot/PYSEC-2023-37.yaml
- https://jinja.palletsprojects.com/en/3.0.x/sandbox/#sandbox
CVE-2023-25657 · published · modified · JSON