Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-54916— NetBox Device Type Library: Module Shadowing Bypass of prior pickle fix - RCE via missing `tests/__init__.py` + SSRF via unfixed `NETBOX_DT_LIBRARY_URL` → Cloud Metadata credential theft

Quick assessment

Affected
netbox-community devicetype-library
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

NetBox Device Type Library 是一个供导入 NetBox 的社区贡献的设备类型定义集合。由于缺少 文件，且未设置 ，导致 pytest 的默认“prepend”导入模式会在测试收集阶段将 目录置于 的最前端。这使得未经验证的贡献者可以通过添加如 这样的模块来遮蔽（shadow）GitPython 库，从而在 执行 时生效；或者通过添加 实现在测试收集时自动执行代码。Python 会在任何测试函数运行之前导入并执行该模块，从而允许攻击者在 GitHub Actions 运行环境中执行任意代码、

CVSS 8.8 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-54916

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
NetBox Device Type Library: Module Shadowing Bypass of prior pickle fix - RCE via missing `tests/__init__.py` + SSRF via unfixed `NETBOX_DT_LIBRARY_URL` → Cloud Metadata credential theft
Source: CVE Program / CVE List V5
Vulnerability Description
NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. The absence of tests/init.py and the lack of --import-mode=importlib cause pytest prepend import mode to place the tests directory at the front of sys.path during collection. An unauthenticated contributor can add a module such as tests/git.py that shadows GitPython when tests/definitions_test.py executes from git import Git, Repo, or add tests/conftest.py for automatic collection-time execution. Python imports and runs the pull-request module before any test function, allowing arbitrary code execution on the GitHub Actions runner, test-result tampering, and access to tokens or network resources exposed to the workflow. This module-shadowing path is independent of the earlier pickle deserialization flaw and the separately tracked NETBOX_DT_LIBRARY_URL issue. This vulnerability is fixed by commit b0d9a3dadd0a0a9d3c93b0b2777559fd4bad1037.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
对搜索路径元素未加控制
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
netbox-community devicetype-library < b0d9a3dadd0a0a9d3c93b0b2777559fd4bad1037g -

II. Public POCs for CVE-2026-54916

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-54916

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-54916 (2)

Vendor Advisories for CVE-2026-54916 (1)

Same Patch Batch · netbox-community · 2026-09-17 · 3 CVEs total

CVE-2026-54752 9.6 CRITICAL NetBox Device Type Library: Insecure Pickle Deserialization in Test Suite Allows Remote Co
CVE-2026-54918 5.3 MEDIUM NetBox Device Type Library: PR-controllable upstream clone URL (NETBOX_DT_LIBRARY_URL) ena

IV. Related Vulnerabilities

Same product: devicetype-library
Same vendor: netbox-community
Same weakness: CWE-427

V. Comments for CVE-2026-54916

No comments yet

Leave a comment