Vulnerability in Nautobot
CVE-2025-49142
Nautobot is a Network Source of Truth and Network Automation Platform. All users of Nautobot versions prior to 2.4.10 or prior to 1.6.32 are potentially affected. Due to insufficient security configuration of the Jinja2 templating feature…
EPSS: 0.003 (22.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N.
Affected products
- Nautobot — versions < 1.6.32, >= 2.0.0, < 2.4.10
- Networktocode Nautobot
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
- security-advisories@github.com (Patch, x_refsource_MISC)
- security-advisories@github.com (Patch, x_refsource_MISC)
- security-advisories@github.com (Product, x_refsource_MISC)
- security-advisories@github.com (Product, x_refsource_MISC)
Frequently asked questions
- What is CVE-2025-49142?
- CVE-2025-49142 is a high-severity vulnerability in Nautobot, classified under Improper Neutralization of Special Elements Used in a Template Engine. CVSS score: 7.1/10. Published 2025-06-10.
- How severe is CVE-2025-49142?
- High severity. CVSS v3 base score is 7.1 out of 10.