netbox-community devicetype-library Test Harness definitions_test.py Repo.clone_from NETBOX_DT_LIBRARY_URL server-side request forgery

Summaryinfo

A vulnerability was found in netbox-community devicetype-library. It has been rated as critical. Affected is the function Repo.clone_from of the file tests/definitions_test.py of the component Test Harness. Performing a manipulation of the argument NETBOX_DT_LIBRARY_URL results in server-side request forgery. This vulnerability was named CVE-2026-54918. The attack may be initiated remotely. There is no available exploit. To fix this issue, it is recommended to deploy a patch.

Detailsinfo

A vulnerability classified as critical has been found in netbox-community devicetype-library (version unknown). This affects the function Repo.clone_from of the file tests/definitions_test.py of the component Test Harness. The manipulation of the argument NETBOX_DT_LIBRARY_URL with an unknown input leads to a server-side request forgery vulnerability. CWE is classifying the issue as CWE-918. The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. In the affected repository revisions, NETBOX_DT_LIBRARY_URL in tests/test_configuration.py is a free-form tracked constant that an unauthenticated pull-request author can change before the validation test harness runs. During pytest collection, tests/definitions_test.py passes the value to Repo.clone_from and create_remote("upstream").fetch(), causing blind Git smart-HTTP requests to an attacker-selected host or loading attacker-controlled tests/known-*.json validation caches. The blind request cannot set arbitrary metadata-service headers or return response bodies, and this path does not execute remote Git hooks, but substituted known data can bypass slug, module, and rack uniqueness validation. This vulnerability is fixed in commit 8980c690097e92f5028c7e6df402b327d827ecd5.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-54918 since 06/16/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. It demands that the victim is doing some kind of user interaction. Technical details of the vulnerability are known, but there is no available exploit.

Applying the patch 8980c690097e92f5028c7e6df402b327d827ecd5 is able to eliminate this problem.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Software Library

Vendor

• netbox-community

Name

• devicetype-library

Website

• Product: https://github.com/netbox-community/devicetype-library/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion