AIKIDO-2026-937906

TL;DR

Nautobot assigns user-controlled model fields directly to a form field's help_text, which is rendered with Django's |safe filter in render_field.html and bypasses auto-escaping. A user with permission to create or edit Relationships or Module Families can store an HTML or JavaScript payload in a Relationship description or a Module Family name. The payload then executes in the browser of any user, including administrators, who opens an affected create or edit form, enabling session or token theft and actions performed as the victim. The fix renders these fields through Nautobot's Markdown/HTML-safe helpers so the stored content is escaped instead of trusted.