CVE-2025-57543

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-03-16 · updated 2026-06-17
Weakness: CWE-79

Description

Cross Site scripting vulnerability (XSS) in NetBox 4.3.5 "comment" field on object forms. An attacker can inject arbitrary HTML, which will be rendered in the web UI when viewed by other users. This could potentially lead to user interface redress attacks or be escalated to XSS in certain contexts.

Affected products

NetBox: 4.3.5

References

https://gist.github.com/MerttTuran/d94acff59816bfd9492d1a738e89ebb4
https://gist.github.com/MerttTuran/d94acff59816bfd9492d1a738e89ebb4

Get alerted when CVE-2025-57543 or the next vulnerability affects your stack