netbox-data-flows has stored XSS in ObjectAlias names rendered inside DataFlow tables
Date: 2026-05
Affected: pip/netbox-data-flows
Attack vector: xss
Category: vulnerability-disclosure
Severity: High
CWE: CWE-79
CVSS: 8.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N)

### Summary An authenticated user who can create or edit `ObjectAlias` objects can store arbitrary HTML/JavaScript in an alias name. That payload is later rendered unescaped in `DataFlow` table views, causing a stored XSS when another user views the affected page. ### Details The issue is caused by unsafe HTML generation in the plugin’s custom table column renderer. Relevant code on `main` (`bf96eac`, same commit as `origin/main` at the time of review): - `netbox_data_flows/models/objectaliases.py` - `ObjectAlias.name` is user-controlled (`CharField`) - `ObjectAlias.__str__()` returns `self.name` directly - `netbox_data_flows/tables/dataflows.py` - `DataFlowTable.sources` and `DataFlowTable.destinations` use `ObjectAliasListColumn` - `netbox_data_flows/tables/columns.py` - `ObjectAliasListColumn.render()` calls `object_list_to_string(value.all(), linkify=True)` - `netbox_data_flows/utils/helpers.py` - `object_list_to_string()` builds raw anchor tags with: ```python mark_safe(separator.join(f'<a href="{o.get_absolute_url()}">{o}</a>' for o in objects)) ``` The alias text (`{o}`) is inserted into HTML without escaping, then the whole string is marked safe. Because `ObjectAlias.__str__()` returns the user-supplied name, HTML/JS in the alias name is executed in the victim’s browser. This affects any page rendering `DataFlowTable`, including at least: - the main Data Flow list page - model tabs that reuse `DataFlowTable` ### PoC Environment: - NetBox wi


Mitigations:

Architectural layers (MAESTRO):