CVE-2026-54918: NetBox Device Type Library: PR-controllable upstream clone URL (NETBOX_DT_LIBRARY_URL) enables SSRF and test-data substitution from CI
NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. In the affected repository revisions, NETBOXDTLIBRARYURL in tests/testconfiguration.py is a free-form tracked constant that an unauthenticated pull-request author can change before the validation test harness runs. During pytest collection, tests/definitionstest.py passes the value to Repo.clonefrom and createremote("upstream").fetch(), causing blind Git smart-HTTP requests to an attacker-selected host or loading attacker-controlled tests/known-.json validation caches. The blind request cannot set arbitrary metadata-service headers or return response bodies, and this path does not execute remote Git hooks, but substituted known data can bypass slug, module, and rack uniqueness validation. This vulnerability is fixed in commit 8980c690097e92f5028c7e6df402b327d827ecd5.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
NetBox Device Type Library (NETBOX_DT_LIBRARY_URL)to a version that resolves this vulnerability.Fixed in 8980c690097e92f5028c7e6df402b327d827ecd5
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
CI environments that run the repository's pytest validation workflow on changes from unauthenticated pull-request authors are exposed. The affected path is triggered during pytest collection, before the validation tests run.
What does an attacker need to exploit it?
An attacker needs the ability to submit a pull request that changes the tracked NETBOX_DT_LIBRARY_URL constant in tests/test_configuration.py, and that pull request must be processed by the CI validation harness. No authentication is required for the resulting outbound Git smart-HTTP request.
What can the attacker do through the vulnerable path?
They can cause a blind Git smart-HTTP request to an attacker-selected host or supply controlled known-*.json validation-cache data. The substituted data can bypass slug, module, and rack uniqueness validation; the request cannot set arbitrary metadata-service headers or expose response bodies, and remote Git hooks are not executed.
What should teams do if they cannot immediately apply the fix?
Avoid running the affected pytest validation workflow against untrusted pull requests, or ensure untrusted contributors cannot modify NETBOX_DT_LIBRARY_URL before CI runs. The issue is fixed in commit 8980c690097e92f5028c7e6df402b327d827ecd5.
How can I determine whether a CI run was targeted?
Review pull requests and CI job inputs for changes to NETBOX_DT_LIBRARY_URL in tests/test_configuration.py. Also inspect CI network logs for Git smart-HTTP requests to unexpected upstream hosts and validation runs using unexpected known-*.json cache data.