CVE-2026-54918

Name of the Vulnerable Software and Affected Versions NetBox Device Type Library (affected versions not specified)

Description An unauthenticated pull-request author can modify the NETBOX DT LIBRARY URL constant in tests/test configuration.py before the validation test harness executes. During pytest collection, the tests/definitions test.py file passes this value to the Repo.clone from and create remote("upstream").fetch() functions. This leads to blind Git smart-HTTP requests being sent to a host selected by the attacker or the loading of attacker-controlled tests/known-*.json validation caches. While the request cannot set arbitrary metadata-service headers, return response bodies, or execute remote Git hooks, the use of substituted known data can allow the bypass of slug, module, and rack uniqueness validation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.