NetBox Reflected Cross-Site Scripting Vulnerability in Error Handling Logic

A reflected cross-site scripting vulnerability has been identified in NetBox versions 2.11.0 through 3.7.x. The issue arises in the ProtectedError handling logic, where object names are incorporated into HTML error messages without adequate escaping. This flaw allows user-controlled content to be displayed in the web interface when a deletion attempt fails due to protected relationships. Consequently, it could enable the execution of arbitrary client-side code within the context of a privileged user.

Impact

Exploitation of this vulnerability could lead to reflected cross-site scripting, allowing for the execution of malicious scripts in the context of the user.