Is CVE-2026-54916 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-54916 being exploited in the wild.

How severe is CVE-2026-54916?

High severity, with a CVSS score of 8.8, published 17 September 2026.

Which products and versions are affected?

NetBox Community Device Type Library prior to commit b0d9a3dadd0a0a9d3c93b0b2777559fd4bad1037.

Is there a fix for CVE-2026-54916?

A patch was published on 2026-06-09: Fix merged in commit b0d9a3dadd0a0a9d3c93b0b2777559fd4bad1037 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-54916 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-54916?

Check whether you run NetBox Community Device Type Library at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54916: NetBox Device Type Library module shadowing in pytest

CVE-2026-54916 · Severity: high · CVSS 8.8 · Published 2026-09-17

NetBox Device Type Library is a GitHub community repository that stores device configuration templates imported into NetBox network management systems. A misconfiguration in the test framework allows untrusted pull requests to execute arbitrary Python code on the GitHub Actions runner by placing malicious modules in the tests directory that shadow legitimate imports, potentially compromising GitHub tokens, tampering with test results, and accessing network resources accessible to the CI environment.

Technologies: NetBox Community Device Type Library. Vendors: NetBox Community.

Quick answers

Is CVE-2026-54916 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-54916 being exploited in the wild.
How severe is CVE-2026-54916?: High severity, with a CVSS score of 8.8, published 17 September 2026.
Which products and versions are affected?: NetBox Community Device Type Library prior to commit b0d9a3dadd0a0a9d3c93b0b2777559fd4bad1037.
Is there a fix for CVE-2026-54916?: A patch was published on 2026-06-09: Fix merged in commit b0d9a3dadd0a0a9d3c93b0b2777559fd4bad1037 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54916 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-54916?: Check whether you run NetBox Community Device Type Library at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a module-shadowing attack enabled by pytest's prepend import mode combined with a missing tests/__init__.py file. When pytest collects tests without restrictive scope settings, it places the tests directory at the front of sys.path. An attacker can contribute a pull request adding malicious modules (e.g., tests/git.py or tests/conftest.py) that shadow legitimate imports like GitPython before test execution. The conftest.py variant executes at collection time before any test functions run, achieving arbitrary code execution. The vulnerability affects the GitHub Actions CI/CD pipeline used to validate community-contributed device definitions and is fixed by adding pytest configuration restrictions (testpaths, confcutdir, --noconftest), creating tests/__init__.py, and requiring maintainer review for changes to the tests directory.

Affected products

NetBox Community Device Type Library prior to commit b0d9a3dadd0a0a9d3c93b0b2777559fd4bad1037

Timeline

2026-09-17: disclosed: CVE-2026-54916 published
2026-06-09: patched: Fix merged in commit b0d9a3dadd0a0a9d3c93b0b2777559fd4bad1037

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.