CVE-2026-54752 Details
Description
NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. The validation test harness can deserialize pull-request-controlled tracked pickle cache files through pickle.load in the read_pickle_data function in tests/pickle_operations.py. An unauthenticated contributor can change USE_LOCAL_KNOWN_SLUGS in tests/test_configuration.py and supply a crafted tests/known-modules.pickle or tests/known-racks.pickle file that tests/definitions_test.py loads when pytest runs. Deserialization invokes attacker-controlled object reduction behavior, allowing arbitrary code execution in the GitHub Actions runner or in a maintainer process that runs the tests, with the confidentiality, integrity, and availability of reachable resources at risk. This vulnerability is fixed with commit 1c6f7e2b93589b965318c6e67ac3504831f0e71e.
A vulnerability exists in the NetBox Device Type Library's test harness, allowing any unauthenticated GitHub user to execute arbitrary code on the CI runner or a maintainer's local machine. This is achieved by manipulating a tracked pickle cache file that the test suite deserializes using 'pickle.load()', a process that executes embedded code. The vulnerability arises from a PR-controllable configuration flag that can redirect the test harness to an attacker-controlled repository, facilitating the exploitation. The issue is present in the repository's CI/test tooling, specifically in the 'pickle_operations' module, and affects all commits from '15a3e7a9d1' through '1db39f9789'.
The vulnerability has been fixed by removing the use of pickle files in the test harness and replacing them with JSON-formatted data. Contributors should ensure that 'USE_LOCAL_KNOWN_SLUGS' is not settable from within a pull request, and instead source this value from a CI-side environment variable. Additionally, the 'pickle file change' detection mechanism should be updated to monitor all three known data cache files and run before the 'pytest' step, preventing the execution of attacker-controlled deserialization.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 17, 2026CISA-ADP
Assessed Sep 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/netbox-community/devicetype-library/security/advisories/GHSA-492p-5wp7-2w7c | CISA-ADP | AdvisoryBundleRemedyVendor |
| https://github.com/netbox-community/devicetype-library/commit/1c6f7e2b93589b965318c6e67ac3504831f0e71e | [email protected] | Source CodeVendor |
| https://github.com/netbox-community/devicetype-library/pull/4238 | [email protected] | Issue TrackingVendor |
| https://github.com/netbox-community/devicetype-library/security/advisories/GHSA-492p-5wp7-2w7c | [email protected] | AdvisoryBundleRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-502 | Deserialization of Untrusted Data | [email protected] |
| CWE-829 | Inclusion of Functionality from Untrusted Control Sphere | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| netbox-community/devicetype-library | >= 15a3e7a9d1, <= 1db39f9789 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 21, 2026 | CVE Modified | CISA-ADP |
| Sep 17, 2026 | New CVE Received | [email protected] |