CVE-2025-49142

2 advisories.

PyPI/nautobot CVE-2025-49142: medium

Nautobot vulnerable to secrets exposure and data manipulation through Jinja2 templating

Action: Upgrade nautobot to 1.6.32 or later.

pip install nautobot==1.6.32

pip install nautobot==2.4.10

Affected

introduced	fixed	last affected
0	1.6.32	-
2.0.0	2.4.10	-

Fixed versions

1.6.32

2.4.10

Sources

osv: GHSA-wjw6-95h5-4jpx
https://github.com/nautobot/nautobot/security/advisories/GHSA-wjw6-95h5-4jpx
https://nvd.nist.gov/vuln/detail/CVE-2025-49142
https://github.com/nautobot/nautobot/pull/7417
https://github.com/nautobot/nautobot/pull/7429
https://docs.djangoproject.com/en/4.2/ref/templates/api/#alters-data-description
https://github.com/nautobot/nautobot
https://github.com/pypa/advisory-database/tree/main/vulns/jinja2/PYSEC-2025-74.yaml
https://github.com/pypa/advisory-database/tree/main/vulns/nautobot/PYSEC-2025-79.yaml
https://jinja.palletsprojects.com/en/stable/sandbox

CVE-2025-49142 · published 2025-06-10T20:17:15Z · modified 2026-06-09T17:11:19.526666515Z · JSON

PyPI/nautobot CVE-2025-49142: high 7.1

Nautobot is a Network Source of Truth and Network Automation Platform. All users of Nautobot versions prior to 2.4.10 or prior to 1.6.32 are potentially affected. Due to insufficient security configur