netbox-community devicetype-library Test Collection tests/__init__.py access control

Summaryinfo

A vulnerability classified as critical was found in netbox-community devicetype-library. This vulnerability affects unknown code of the file tests/__init__.py of the component Test Collection. Such manipulation leads to access control. This vulnerability is documented as CVE-2026-54916. The attack can be executed remotely. There is not any exploit available. It is advisable to implement a patch to correct this issue.

Detailsinfo

A vulnerability, which was classified as critical, has been found in netbox-community devicetype-library (version unknown). Affected by this issue is an unknown function of the file tests/__init__.py of the component Test Collection. The manipulation with an unknown input leads to a access control vulnerability. Using CWE to declare the problem leads to CWE-284. The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. Impacted is confidentiality, integrity, and availability. CVE summarizes:

NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. The absence of tests/init.py and the lack of --import-mode=importlib cause pytest prepend import mode to place the tests directory at the front of sys.path during collection. An unauthenticated contributor can add a module such as tests/git.py that shadows GitPython when tests/definitions_test.py executes from git import Git, Repo, or add tests/conftest.py for automatic collection-time execution. Python imports and runs the pull-request module before any test function, allowing arbitrary code execution on the GitHub Actions runner, test-result tampering, and access to tokens or network resources exposed to the workflow. This module-shadowing path is independent of the earlier pickle deserialization flaw and the separately tracked NETBOX_DT_LIBRARY_URL issue. This vulnerability is fixed by commit b0d9a3dadd0a0a9d3c93b0b2777559fd4bad1037.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-54916 since 06/16/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1068.

Applying the patch b0d9a3dadd0a0a9d3c93b0b2777559fd4bad1037 is able to eliminate this problem.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Software Library

Vendor

• netbox-community

Name

• devicetype-library

Website

• Product: https://github.com/netbox-community/devicetype-library/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion