CVE-2025-57543.txt

CVE-2025-57543

Product: NetBox
Vendor: NetBox Maintainers / NS1 (originally developed by DigitalOcean)
Version Affected: 4.3.5
Component: comment input fields in various forms (netbox/templates/generic/object_comment.html, netbox/views/generic.py)

Vulnerability Type

HTML Injection

Description

An HTML Injection vulnerability exists in NetBox v4.3.5. The "comment" input fields in various object forms do not sanitize or escape user-supplied HTML.

As a result, arbitrary HTML can be injected and rendered in the web interface. While this does not directly execute JavaScript, it can be abused to alter the UI, mislead users, or in some environments serve as a stepping stone to more severe attacks if combined with other flaws.

NetBox is an open-source infrastructure resource modeling (IRM) tool used for managing networks, devices, and IP address assignments in enterprise environments.

Attack Vector

An attacker enters a malicious payload in the "comment" field of a NetBox object (e.g., device, IP address).

Example payloads:

<a href="https://attacker.com">Click here</a>

<b>Important Notice</b>

<marquee>Injected Content</marquee>


When another user views the object details, the HTML is rendered in the browser.

Impact

Arbitrary HTML is injected into the rendered page.

Possible user interface manipulation or phishing-style redirection.

Exploitation does not require authentication (depending on access controls in the deployment).

Discoverer

Mert Turan

Reference

https://demo.netbox.dev/

CVE ID

CVE-2025-57543

HTML Injection vulnerability in NetBox 4.3.5 "comment" field on object forms. An attacker can inject arbitrary HTML, which will be rendered in the web UI when viewed by other users. This could potentially lead to misleading UI modifications or redirection.