Vulnerability · Published Oct 1, 2026 · Assigned by GitHub_M

CVE-2026-55251NetBox Device Type Library: Arbitrary Code Execution on CI Runner Through Malicious requirements.txt, .pre-commit-hooks-config.yaml, and .gitmodules Files

Medium 6.5

In plain English

A medium-severity code injection in devicetype-library from netbox-community. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.1%top 97.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. Prior to commit f41fc1e, the CI workflow .github/workflows/validation.yml runs on pull_request and executes code supplied by the pull request before any maintainer review. Three PR-editable files drive this: "requirements.txt", ".pre-commit-hooks-config.yaml" / ".pre-commit-yamlfmt-config.yaml", and ".gitmodules". A contributor with no special repository access could open a pull request that modifies these files and have their code run on the CI runner. This issue has been patched via commit f41fc1e.

Affected products (as reported)

Vendor	Product	Versions
netbox-community	devicetype-library	< f41fc1e48dec8d7d31afba5f13a8c73652ff5796

Weakness: CWE-94, CWE-494, CWE-829 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

References

https://github.com/netbox-community/devicetype-library/security/advisories/GHSA-5x2m-x42f-g4cm x_refsource_CONFIRM
https://github.com/netbox-community/devicetype-library/commit/f41fc1e48dec8d7d31afba5f13a8c73652ff5796 x_refsource_MISC