CVE-2026-54916 Details

A remote code execution vulnerability has been identified in the NetBox Device Type Library, specifically in the CI test harness used with pytest. This issue arises from Python module shadowing, where an unauthenticated contributor can exploit the absence of an 'init.py' file in the tests directory. The lack of this file allows pytest to prepend the tests directory to the front of 'sys.path', enabling the execution of arbitrary code on the GitHub Actions runner. The vulnerability was introduced because the tests directory could import attacker-controlled modules that shadow legitimate packages, such as GitPython. When the test suite is executed, the imported module can execute malicious code before any test functions run, leading to unauthorized actions and potential tampering with test results.

The vulnerability has been fixed by adding a 'tests/init.py' file to prevent module shadowing, updating the CI workflows to enhance security, and implementing a detection mechanism for changes to the test harness that require maintainer review.