Read the docs
TI-2026-39558 Aliases CVE-2026-54752

Deserialization of untrusted data in netbox-community devicetype-library

Priority HIGH 76CWE-502Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-502.

Summary

NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. The validation test harness can deserialize pull-request-controlled tracked pickle cache files through pickle.load in the read_pickle_data function in tests/pickle_operations.py. An unauthenticated contributor can change USE_LOCAL_KNOWN_SLUGS in tests/test_configuration.py and supply a crafted tests/known-modules.pickle or tests/known-racks.pickle file that tests/definitions_test.py loads when pytest runs. Deserialization invokes attacker-controlled object reduction behavior, allowing arbitrary code execution in the GitHub Actions runner or in a maintainer process that runs the tests, with the confidentiality, integrity, and availability of reachable resources at risk. This vulnerability is fixed with commit 1c6f7e2b93589b965318c6e67ac3504831f0e71e.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0066 51st percentileScored 2026-11-07
Fix Fixed devicetype-library (netbox-community): 1c6f7e2b93589b965318c6e67ac3504831f0e71e

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
netbox-communitydevicetype-librarybefore 1c6f7e2b93589b965318c6e67ac3504831f0e71e1c6f7e2b93589b965318c6e67ac3504831f0e71ePatch availableCNA
  • devicetype-library Vendornetbox-community Affected before 1c6f7e2b93589b965318c6e67ac3504831f0e71e Fixed in 1c6f7e2b93589b965318c6e67ac3504831f0e71e Patch available CNA

Remediation

  • Fix · CNA devicetype-library (netbox-community) Fixed in 1c6f7e2b93589b965318c6e67ac3504831f0e71e

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-54752
  2. 2026-10-08 EPSS moved to the 50th–90th percentile

References

Other 3

  • TI-2026-23330 NetBox 4.3.5 - 4.5.4 RCE via RenderTemplateMixin CVSS 4.0HIGH 8.7
  • TI-2026-39924 Code injection in netbox-community devicetype-library CVSS 3.1MEDIUM 6.5
  • TI-2026-58964 NetBox through 4.7.0 Credential Disclosure via REST and GraphQL APIs CVSS 4.0HIGH 7.1
  • TI-2026-84457 Broken access control in NetBox bulk component creation CVSS 4.0MEDIUM 5.3
  • TI-2026-39685 Uncontrolled search path in netbox-community devicetype-library CVSS 3.1HIGH 8.8
  • TI-2026-68595 Template injection in NetBox custom links leaks session cookies CVSS 4.0MEDIUM 6.9
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences