Advisories · Technology

netbox-community devicetype-library.

Every CVE that names netbox-community devicetype-library among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-55251 CVE record

CVSS 6.5 Medium

NetBox Device Type Library: Arbitrary Code Execution on CI Runner Through Malicious requirements.txt, .pre-commit-hooks-config.yaml, and .gitmodules Files
- netbox-community devicetype-library
- Code injection
- CWE-494
Not analysed yet 1 Oct 2026
CVE-2026-54918 CVE record

CVSS 5.3 Medium

NetBox Device Type Library: PR-controllable upstream clone URL (NETBOX_DT_LIBRARY_URL) enables SSRF and test-data substitution from CI
- netbox-community devicetype-library
- Server-side request forgery (SSRF)
- CWE-15
Not analysed yet 17 Sept 2026
CVE-2026-54916 CVE record

CVSS 8.8 High

NetBox Device Type Library: Module Shadowing Bypass of prior pickle fix - RCE via missing `tests/__init__.py` + SSRF via unfixed `NETBOX_DT_LIBRARY_URL` → Cloud Metadata credential theft
- netbox-community devicetype-library
- CWE-427
- CWE-829
Not analysed yet 17 Sept 2026
CVE-2026-54752 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

NetBox Device Type Library: Insecure Pickle Deserialization in Test Suite Allows Remote Code Execution via Malicious Pull Request
- netbox-community devicetype-library
- Insecure deserialization
- CWE-829
Not analysed yet 17 Sept 2026