{"id":"CVE-2026-104073","published":"2026-10-06T19:17:40.143","lastModified":"2026-10-07T15:16:58.313","description":"NetBox versions 2.9.5 before 4.7.0 contain a server-side template injection vulnerability that allows a low-privileged user with the \"Can add custom links\" permission to steal session cookies and API tokens of other users by exposing the raw Django HttpRequest object to the Jinja2 template context. Attackers can craft a custom link template embedding request.COOKIES['sessionid'] or a user's API token into an img src URL, which bypasses the clean_html sanitizer and auto-exfiltrates the victim's credentials to an attacker-controlled host when a privileged user views the object, enabling full account takeover.","cvssScore":7.6,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N","cwes":["CWE-79","CWE-668"],"vendors":[],"products":[],"references":[{"url":"https://github.com/netbox-community/netbox/issues/22607","tags":[]},{"url":"https://github.com/netbox-community/netbox/pull/22616","tags":[]},{"url":"https://github.com/netbox-community/netbox/releases#release-v4.7.0","tags":[]},{"url":"https://www.vulncheck.com/advisories/netbox-session-hijacking-via-custom-links","tags":[]}],"exploitRefs":[{"url":"https://github.com/netbox-community/netbox/issues/22607","tags":[]},{"url":"https://github.com/netbox-community/netbox/pull/22616","tags":[]},{"url":"https://github.com/netbox-community/netbox/releases#release-v4.7.0","tags":[]}],"hasPoc":true,"ai":{"summary":"A server-side template injection vulnerability in NetBox allows low-privileged users to craft custom links that can steal session cookies and API tokens from other users by embedding request data directly into Jinja2 templates. This enables attackers to hijack user sessions and gain full access to their accounts.","exploitability":"Moderately difficult to exploit as it requires a user with 'Can add custom links' permission to create a malicious template, but once created, the attack automatically triggers when a privileged user views the affected object.","blast_radius":"The vulnerability could lead to widespread account takeovers across the NetBox instance, especially if multiple users have elevated privileges or API access, as the attack can exfiltrate credentials without requiring user interaction beyond viewing an object.","remediation":"Upgrade to NetBox 4.7.0 or later to remediate this vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["template-injection","session-hijacking","web"],"model":"garnet-coder","analyzedAt":"2026-10-15T09:02:02.657Z"}}