{"id":"CVE-2026-54916","summary":"NetBox Device Type Library: Module Shadowing Bypass of prior pickle fix - RCE via missing `tests/__init__.py` + SSRF via unfixed `NETBOX_DT_LIBRARY_URL` → Cloud Metadata credential theft","details":"NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. The absence of tests/init.py and the lack of --import-mode=importlib cause pytest prepend import mode to place the tests directory at the front of sys.path during collection. An unauthenticated contributor can add a module such as tests/git.py that shadows GitPython when tests/definitions_test.py executes from git import Git, Repo, or add tests/conftest.py for automatic collection-time execution. Python imports and runs the pull-request module before any test function, allowing arbitrary code execution on the GitHub Actions runner, test-result tampering, and access to tokens or network resources exposed to the workflow. This module-shadowing path is independent of the earlier pickle deserialization flaw and the separately tracked NETBOX_DT_LIBRARY_URL issue. This vulnerability is fixed by commit b0d9a3dadd0a0a9d3c93b0b2777559fd4bad1037.","aliases":["GHSA-wwg5-825x-83g6"],"modified":"2026-09-20T11:30:20.019297400Z","published":"2026-09-17T20:01:14.294Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54916.json","unresolved_ranges":[{"source":"AFFECTED_FIELD","extracted_events":[{"fixed":"b0d9a3dadd0a0a9d3c93b0b2777559fd4bad1037g"}]}],"cna_assigner":"GitHub_M","cwe_ids":["CWE-427","CWE-829"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54916.json"},{"type":"ADVISORY","url":"https://github.com/netbox-community/devicetype-library/security/advisories/GHSA-wwg5-825x-83g6"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54916"},{"type":"FIX","url":"https://github.com/netbox-community/devicetype-library/commit/b0d9a3dadd0a0a9d3c93b0b2777559fd4bad1037"},{"type":"FIX","url":"https://github.com/netbox-community/devicetype-library/pull/4239"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/netbox-community/devicetype-library","events":[{"introduced":"0"},{"fixed":"b0d9a3dadd0a0a9d3c93b0b2777559fd4bad1037"}],"database_specific":{"source":"REFERENCES"}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54916.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}]}