CVE-2026-54752

NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. The validation test harness can deserialize pull-request-controlled tracked pickle cache files through pickle.load in the read_pickle_data function in tests/pickle_operations.py. An unauthenticated contributor can change USE_LOCAL_KNOWN_SLUGS in tests/test_configuration.py and supply a crafted tests/known-modules.pickle or tests/known-racks.pickle file that tests/definitions_test.py loads when pytest runs. Deserialization invokes attacker-controlled object reduction behavior, allowing arbitrary code execution in the GitHub Actions runner or in a maintainer process that runs the tests, with the confidentiality, integrity, and availability of reachable resources at risk. This vulnerability is fixed with commit 1c6f7e2b93589b965318c6e67ac3504831f0e71e.

• CWE-502
• CWE-829

• https://github.com/netbox-community/devicetype-library/commit/1c6f7e2b93589b965318c6e67ac3504831f0e71e
• https://github.com/netbox-community/devicetype-library/pull/4238
• https://github.com/netbox-community/devicetype-library/security/advisories/GHSA-492p-5wp7-2w7c
• https://github.com/netbox-community/devicetype-library/security/advisories/GHSA-492p-5wp7-2w7c

Published

Sep 17, 2026

Last Modified

Sep 24, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-54741Lemmy is a link aggregator and forum for the fediverse. Prio…5.3
• CVE-2026-54742Lemmy is a link aggregator and forum for the fediverse. From…5.1
• CVE-2026-54743Lemmy is a link aggregator and forum for the fediverse. Prio…6.4
• CVE-2026-54745Kubeflow Pipelines enables users to build and deploy portabl…10
• CVE-2026-54746Hatchet is a platform for orchestrating background tasks, AI…6.4
• CVE-2026-5475A vulnerability was determined in NASA cFS up to 7.0.0. This…5.5
• CVE-2026-54753Nx is a monorepo solution for TypeScript and polyglot codeba…5.9
• CVE-2026-54754Klever-Go is the Go implementation of the Klever blockchain …9.6
• CVE-2026-54755Klever-Go is the Go implementation of the Klever blockchain …9.6
• CVE-2026-54756Jodit Editor is a WYSIWYG editor with written in pure TypeSc…6.3
• CVE-2026-54757Compliance-trestle (Trestle) is a Python SDK and command-lin…7.8
• CVE-2026-54758Notepad++ is a free and open-source source code editor. Prio…7.8