CVE-2026-54916

Pytest import-path shadowing lets untrusted PR run arbitrary code in CI.

• CVSS 8.8
• 427
• Design Defects
• Remote

NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. The absence of tests/init.py and the lack of –import-mode=importlib cause pytest prepend import mode to place the tests directory at the front of sys.path during collection. An unauthenticated contributor can add a module such as tests/git.py that shadows GitPython when tests/definitions_test.py executes from git import Git, Repo, or add tests/conftest.py for automatic collection-time execution. Python imports and runs the pull-request module before any test function, allowing arbitrary code execution on the GitHub Actions runner, test-result tampering, and access to tokens or network resources exposed to the workflow. This module-shadowing path is independent of the earlier pickle deserialization flaw and the separately tracked NETBOX_DT_LIBRARY_URL issue. This vulnerability is fixed by commit b0d9a3dadd0a0a9d3c93b0b2777559fd4bad1037.

CVE

CVE-2026-54916

CWE

427

CVSS base score

8.8

Published

2026-09-17

OWASP

A08 Software and Data Integrity Failures

Orthogonal defect classification

Interface

Code defect classification

Incorrect Interface

Category

Design Defects

Subcategory

Security Misconfigurations

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Affected component

NetBox Device Type Library

Fixed by upgrading

Yes

Solution

Upgrade to NetBox Device Type Library v3.5.0 (or any later release that includes commit b0d9a3d).

# VULNERABLE: imports 'git' which can be shadowed by a malicious tests/git.py
from git import Git, Repo

def get_latest_commit(repo_path):
    repo = Repo(repo_path)
    return repo.head.commit.hexsha

# FIX: validate origin of 'git' module before importing it
import importlib, os, sys
_git_mod = importlib.import_module('git')
_git_dir = os.path.abspath(os.path.dirname(_git_mod.__file__))
if not _git_dir.startswith(sys.prefix):
    raise ImportError("Unsafe import of 'git' module from untrusted location")
from git import Git, Repo

def get_latest_commit(repo_path):
    repo = Repo(repo_path)
    return repo.head.commit.hexsha

__VAITP_MODEL_REFUSED__

@misc{vaitp:cve202654916,
  title        = {{Pytest import-path shadowing lets untrusted PR run arbitrary code in CI.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2026},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2026-54916},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2026-54916/}}
}