---
id: CVE-2026-54916
title: >-
  NetBox Device Type Library is a collection of community-sourced device type
  definitions for import into NetBox
summary: >-
  NetBox Device Type Library is a collection of community-sourced device type
  definitions for import into NetBox. The absence of tests/init.py and the lack
  of --import-mode=importlib cause pytest prepend import mode to place the tests
  dire…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'
cwe:
  - CWE-427
  - CWE-829
vendor: netbox-community
product: devicetype-library
affected:
  - devicetype-library < b0d9a3dadd0a0a9d3c93b0b2777559fd4bad1037g
published: '2026-09-17'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T21:25:27.050'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-54916'
references:
  - url: >-
      https://github.com/netbox-community/devicetype-library/commit/b0d9a3dadd0a0a9d3c93b0b2777559fd4bad1037
    label: security-advisories@github.com
  - url: 'https://github.com/netbox-community/devicetype-library/pull/4239'
    label: security-advisories@github.com
  - url: >-
      https://github.com/netbox-community/devicetype-library/security/advisories/GHSA-wwg5-825x-83g6
    label: security-advisories@github.com
tags:
  - nvd
  - cve.org
epss: 0.00611
epssPercentile: 0.4702
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-18T17:24:10.034628Z'
ingestedAt: '2026-09-17T20:28:02.799Z'
---

## Overview

NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. The absence of tests/init.py and the lack of --import-mode=importlib cause pytest prepend import mode to place the tests directory at the front of sys.path during collection. An unauthenticated contributor can add a module such as tests/git.py that shadows GitPython when tests/definitions_test.py executes from git import Git, Repo, or add tests/conftest.py for automatic collection-time execution. Python imports and runs the pull-request module before any test function, allowing arbitrary code execution on the GitHub Actions runner, test-result tampering, and access to tokens or network resources exposed to the workflow. This module-shadowing path is independent of the earlier pickle deserialization flaw and the separately tracked NETBOX_DT_LIBRARY_URL issue. This vulnerability is fixed by commit b0d9a3dadd0a0a9d3c93b0b2777559fd4bad1037.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.