Reflected XSS in NetBox ProtectedError Handling (CVE-2025-69848)

Overview

NetBox is an open-source infrastructure resource modeling and IP address management platform. A reflected cross-site scripting (XSS) vulnerability exists in the ProtectedError exception handling logic.

When a delete operation fails due to protected relationships, object display names are inserted into an HTML error message without proper escaping. This allows user-controlled content to be rendered in the NetBox web interface.

Impact

An attacker with the ability to control object names may cause arbitrary client-side code to execute in the browser of a privileged user viewing the error message. This can lead to session hijacking, privilege escalation, or unauthorized actions within the NetBox interface.

Affected Versions

NetBox 2.11.0 through 3.7.x

Affected Component

utilities/error_handlers.py — ProtectedError handling logic

CVE ID

CVE-2025-69848

Discoverer