Executive brief
NetBox Device Type Library is a GitHub community repository that stores device configuration templates imported into NetBox network management systems. A misconfiguration in the test framework allows untrusted pull requests to execute arbitrary Python code on the GitHub Actions runner by placing malicious modules in the tests directory that shadow legitimate imports, potentially compromising GitHub tokens, tampering with test results, and accessing network resources accessible to the CI environment.
Technical details
The vulnerability is a module-shadowing attack enabled by pytest's prepend import mode combined with a missing tests/__init__.py file. When pytest collects tests without restrictive scope settings, it places the tests directory at the front of sys.path. An attacker can contribute a pull request adding malicious modules (e.g., tests/git.py or tests/conftest.py) that shadow legitimate imports like GitPython before test execution. The conftest.py variant executes at collection time before any test functions run, achieving arbitrary code execution. The vulnerability affects the GitHub Actions CI/CD pipeline used to validate community-contributed device definitions and is fixed by adding pytest configuration restrictions (testpaths, confcutdir, --noconftest), creating tests/__init__.py, and requiring maintainer review for changes to the tests directory.
Affected products
- NetBox Community Device Type Library prior to commit b0d9a3dadd0a0a9d3c93b0b2777559fd4bad1037
Timeline
- 2026-09-17: disclosed: CVE-2026-54916 published
- 2026-06-09: patched: Fix merged in commit b0d9a3dadd0a0a9d3c93b0b2777559fd4bad1037