Is CVE-2026-54918 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-54918 being exploited in the wild.

How severe is CVE-2026-54918?

Medium severity, with a CVSS score of 5.3, published 17 September 2026.

Which products and versions are affected?

NetBox Device Type Library revisions before commit 8980c690097e92f5028c7e6df402b327d827ecd5.

Is there a fix for CVE-2026-54918?

A patch was published on 2026-06-10: Fix merged in commit 8980c690097e92f5028c7e6df402b327d827ecd5 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-54918 attacked?

It is attacked over the network.

Am I affected by CVE-2026-54918?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54918: NetBox Device Type Library Git repository URL injection

CVE-2026-54918 · Severity: medium · CVSS 5.3 · Published 2026-09-17

NetBox Device Type Library is a repository of hardware device definitions used to populate network management systems. An attacker can modify a tracked configuration constant in pull requests to redirect Git operations to an attacker-controlled server, potentially bypassing validation checks and inserting fraudulent device definitions into the library.

Quick answers

Is CVE-2026-54918 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-54918 being exploited in the wild.
How severe is CVE-2026-54918?: Medium severity, with a CVSS score of 5.3, published 17 September 2026.
Which products and versions are affected?: NetBox Device Type Library revisions before commit 8980c690097e92f5028c7e6df402b327d827ecd5.
Is there a fix for CVE-2026-54918?: A patch was published on 2026-06-10: Fix merged in commit 8980c690097e92f5028c7e6df402b327d827ecd5 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54918 attacked?: It is attacked over the network.
Am I affected by CVE-2026-54918?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a URL injection flaw in the NetBox Device Type Library test harness. The NETBOX_DT_LIBRARY_URL constant in tests/test_configuration.py is a free-form, tracked field that an unauthenticated pull-request author can modify. During pytest collection, this untrusted URL is passed to Repo.clone_from() and create_remote("upstream").fetch(), causing blind Git smart-HTTP requests to an attacker-selected host. An attacker can also substitute attacker-controlled known-*.json validation cache files. While the attack cannot set arbitrary headers or execute remote Git hooks, it permits bypassing uniqueness validation on device slugs, modules, and racks. The vulnerability was fixed in commit 8980c690097e92f5028c7e6df402b327d827ecd5 by pinning the repository URL to an allowlist.

Affected products

NetBox Device Type Library revisions before commit 8980c690097e92f5028c7e6df402b327d827ecd5

Timeline

2026-09-17: disclosed
2026-06-10: patched: Fix merged in commit 8980c690097e92f5028c7e6df402b327d827ecd5

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.