Executive brief
NetBox Device Type Library is a repository of hardware device definitions used to populate network management systems. An attacker can modify a tracked configuration constant in pull requests to redirect Git operations to an attacker-controlled server, potentially bypassing validation checks and inserting fraudulent device definitions into the library.
Technical details
The vulnerability is a URL injection flaw in the NetBox Device Type Library test harness. The NETBOX_DT_LIBRARY_URL constant in tests/test_configuration.py is a free-form, tracked field that an unauthenticated pull-request author can modify. During pytest collection, this untrusted URL is passed to Repo.clone_from() and create_remote("upstream").fetch(), causing blind Git smart-HTTP requests to an attacker-selected host. An attacker can also substitute attacker-controlled known-*.json validation cache files. While the attack cannot set arbitrary headers or execute remote Git hooks, it permits bypassing uniqueness validation on device slugs, modules, and racks. The vulnerability was fixed in commit 8980c690097e92f5028c7e6df402b327d827ecd5 by pinning the repository URL to an allowlist.
Affected products
- NetBox Device Type Library revisions before commit 8980c690097e92f5028c7e6df402b327d827ecd5
Timeline
- 2026-09-17: disclosed
- 2026-06-10: patched: Fix merged in commit 8980c690097e92f5028c7e6df402b327d827ecd5