NetBox Community Cross-Site Scripting Vulnerability in Configuration History Feature

A cross-site scripting (XSS) vulnerability has been identified in NetBox Community version 4.1.7. The issue arises in the Configuration History > Add section, where the current value field improperly renders user-supplied HTML. This flaw allows an authenticated attacker to inject malicious JavaScript into any banner field. The XSS payload is triggered when a victim edits a Configuration History version or adds a new one.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, an authenticated user can navigate to the Configuration History > Add section in NetBox Community 4.1.7. Once there, the user can inject a script into the current value field, which will be executed when the configuration history version is edited or a new version is added.