Browser script execution via stored rack-role names

Stored XSS in NetBox 3.5.1 allows remote authenticated users to execute scripts in another user’s browser through a rack-role name. The Create Rack Roles form stores a crafted Name value containing an HTML event handler and later renders it in the rack form’s Role selector without neutralizing executable markup. Exploitation requires permission to create rack roles and a second user to open the Add Rack form; attacker-controlled code then runs in the victim’s authenticated browser context.