CVE-2026-54916

Description

NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. The absence of tests/init.py and the lack of --import-mode=importlib cause pytest prepend import mode to place the tests directory at the front of sys.path during collection. An unauthenticated contributor can add a module such as tests/git.py that shadows GitPython when tests/definitions_test.py executes from git import Git, Repo, or add tests/conftest.py for automatic collection-time execution. Python imports and runs the pull-request module before any test function, allowing arbitrary code execution on the GitHub Actions runner, test-result tampering, and access to tokens or network resources exposed to the workflow. This module-shadowing path is independent of the earlier pickle deserialization flaw and the separately tracked NETBOX_DT_LIBRARY_URL issue. This vulnerability is fixed by commit b0d9a3dadd0a0a9d3c93b0b2777559fd4bad1037.

CVSS 3.1 breakdown

Remediation

No fixed version is recorded in the NVD data. Check the vendor advisory for the latest guidance.

References

• https://github.com/netbox-community/devicetype-library/commit/b0d9a3dadd0a0a9d3c93b0b2777559fd4bad1037
• https://github.com/netbox-community/devicetype-library/pull/4239
• https://github.com/netbox-community/devicetype-library/security/advisories/GHSA-wwg5-825x-83g6

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked