CVE-2026-55251CWE-494CWE-829CWE-94code-injection

CVE-2026-55251

Medium · published October 2, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
1.1
In the wild
Unconfirmed
What it is

NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. Prior to commit f41fc1e, the CI workflow .github/workflows/validation.yml runs on pull_request and executes code supplied by the pull request before any maintainer review. Three PR-editable files drive this: "requirements.txt", ".pre-commit-hooks-config.yaml" / ".pre-commit-yamlfmt-config.yaml", and ".gitmodules". A contributor with no special repository access could open a pull request that modifies these files and have their code run on the CI runner. This issue has been patched via commit f41fc1e.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00107 · 1.1th percentile
Weaknesses
CWE-494 · Download of Code Without Integrity Check; CWE-829 · Inclusion of Functionality from Untrusted Control Sphere; CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2026-10-02T00:17Z
References (3)
https://github.com/netbox-community/devicetype-library/commit/f41fc1e48dec8d7d31afba5f13a8c73652ff5796 · [email protected]https://github.com/netbox-community/devicetype-library/security/advisories/GHSA-5x2m-x42f-g4cm · [email protected]https://github.com/netbox-community/devicetype-library/security/advisories/GHSA-5x2m-x42f-g4cm · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 03 OCT 03:44Z
    EPSS moved — → 0%
    epss
  • 01 OCT 19:49Z
    NetBox Device Type Library: Arbitrary Code Execution on CI Runner Through Malicious requirements.txt, .pre-commit-hooks-config.yaml, and .gitmodules Files
    cvelistv5