{"id":26144,"date":"2026-09-18T08:32:19","date_gmt":"2026-09-18T00:32:19","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-54916"},"modified":"2026-09-18T08:32:19","modified_gmt":"2026-09-18T00:32:19","slug":"cve-2026-54916","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-54916","title":{"rendered":"CVE-2026-54916 [HIGH] &#8211; NetBox Device Type Library is a collection of community-sourced device type definitions fo"},"content":{"rendered":"<p>NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. The absence of tests\/init.py and the lack of &#8211;import-mode=importlib cause pytest prepend import mode to place the tests directory at the front of sys.path during collection. An unauthenticated contributor can add a module such as tests\/git.py that shadows GitPython when tests\/definitions_test.py executes from git import Git, Repo, or add tests\/conftest.py for automatic collection-time execution. Python imports and runs the pull-request module before any test function, allowing arbitrary code execution on the GitHub Actions runner, test-result tampering, and access to tokens or network resources exposed to the workflow. This module-shadowing path is independent of the earlier pickle deserialization flaw and the separately tracked NETBOX_DT_LIBRARY_URL issue. This vulnerability is fixed by commit b0d9a3dadd0a0a9d3c93b0b2777559fd4bad1037.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. The absence of tests\/init.py and the lack of &#8211;import-mode=importlib cause pytest prepen<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-26144","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/26144","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=26144"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=26144"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=26144"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}