Medium 5.3Published Sep 17, 2026

CVE-2026-54918NetBox Device Type Library: PR-controllable upstream clone URL (NETBOX_DT_LIBRARY_URL) enables SSRF and test-data substitution from CI

Updated under an hour ago (2026-10-19 06:30 UTC)

Does this affect you?

It affects netbox-community devicetype-library. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for netbox-community devicetype-library

Exploited in the last 30 days

NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. In the affected repository revisions, NETBOX_DT_LIBRARY_URL in tests/test_configuration.py is a free-form tracked constant that an unauthenticated pull-request author can change before the validation test harness runs. During pytest collection, tests/definitions_test.py passes the value to Repo.clone_from and create_remote("upstream").fetch(), causing blind Git smart-HTTP requests to an attacker-selected host or loading attacker-controlled tests/known-*.json validation caches. The blind request cannot set arbitrary metadata-service headers or return response bodies, and this path does not execute remote Git hooks, but substituted known data can bypass slug, module, and rack uniqueness validation. This vulnerability is fixed in commit 8980c690097e92f5028c7e6df402b327d827ecd5.

CVSS: 5.3 MEDIUM (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness (CWE): CWE-15, CWE-829, CWE-918
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: GitHub_M
NVD analysis: Deferred
Record last updated: Sep 24, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

netbox-community devicetype-library netbox_community:devicetype_library (from the name)	before 8980c690097e92f5028c7e6df402b327d827ecd5	CNA record

References

https://github.com/netbox-community/devicetype-library/security/advisories/GHSA-8cfp-3c4q-xr6xx-refsource-confirm
https://github.com/netbox-community/devicetype-library/pull/4240x-refsource-misc
https://github.com/netbox-community/devicetype-library/commit/8980c690097e92f5028c7e6df402b327d827ecd5x-refsource-misc

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.