NetBox Device Type Library: Module Shadowing Bypass of prior pickle fix - RCE via missing `tests/init.py` + SSRF via unfixed `NETBOX_DT_LIBRARY_URL` → Cloud Metadata credential theft

published 2026-09-17 52 d ago modified 2026-09-24 45 d ago also EUVD-2026-82414

cvss: 8.8; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.6%; EPSS 0.6% chance of exploitation in 30 days, percentile 49%
public exploits: 0; none known

NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. The absence of tests/init.py and the lack of --import-mode=importlib cause pytest prepend import mode to place the tests directory at the front of sys.path during collection. An unauthenticated contributor can add a module such as tests/git.py that shadows GitPython when tests/definitions_test.py executes from git import Git, Repo, or add tests/conftest.py for automatic collection-time execution. Python imports and runs the pull-request module before any test function, allowing arbitrary code execution on the GitHub Actions runner, test-result tampering, and access to tokens or network resources exposed to the workflow. This module-shadowing path is independent of the earlier pickle deserialization flaw and the separately tracked NETBOX_DT_LIBRARY_URL issue. This vulnerability is fixed by commit b0d9a3dadd0a0a9d3c93b0b2777559fd4bad1037.

Patch / fix

links 2

github.com/netbox-community/devicetype-library@b0d9a3d commit
github.com/netbox-community/devicetype-library#4239 pull request

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 51 d ago (2026-09-18)

Exploit prediction

0.61% chance of exploitation in the next 30 days, higher than 49% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	8.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

netbox-community devicetype-library

Classification

Weakness

CWE-427 Uncontrolled Search Path Element
CWE-829 Inclusion of Functionality from Untrusted Control Sphere

References

Sources

CVE List CVE-2026-54916
NVD CVE-2026-54916

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary