devicetype-library — Vulnerabilities & Security Advisories 3

All 3 CVE vulnerabilities found in devicetype-library, with AI-generated Chinese analysis, references, and POCs.

CVE ID	Title	CVSS	Severity	Published
CVE-2026-54918	NetBox Device Type Library: PR-controllable upstream clone URL (NETBOX_DT_LIBRARY_URL) enables SSRF and test-data substitution from CI CWE-15	5.3	Medium	2026-09-17
CVE-2026-54916	NetBox Device Type Library: Module Shadowing Bypass of prior pickle fix - RCE via missing `tests/__init__.py` + SSRF via unfixed `NETBOX_DT_LIBRARY_URL` → Cloud Metadata credential theft CWE-427	8.8	High	2026-09-17
CVE-2026-54752	NetBox Device Type Library: Insecure Pickle Deserialization in Test Suite Allows Remote Code Execution via Malicious Pull Request CWE-502	9.6	Critical	2026-09-17

All 3 known CVE vulnerabilities affecting devicetype-library with full Chinese analysis, references, and POCs where available.