netbox-data-flows versions prior to 1.5.1 contain a stored cross-site scripting (XSS) vulnerability in the ObjectAlias names rendered inside DataFlow tables. Authenticated users with permission to create or edit ObjectAlias objects can inject arbitrary HTML or JavaScript into alias names, which are then rendered unescaped in DataFlow table views. This leads to stored XSS when other users view affected pages, including the main Data Flow list page and model tabs using DataFlowTable.