EUVD-2026-26997Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
9DescriptionCVE.org
NetBox versions 4.3.5 through 4.5.4 contain a remote code execution vulnerability in the RenderTemplateMixin.get_environment_params() method that allows authenticated users with exporttemplate or configtemplate permissions to execute arbitrary code by specifying malicious Python callables in the environment_params field. Attackers can bypass Jinja2 SandboxedEnvironment protections by setting the finalize parameter to any importable Python callable such as subprocess.getoutput, which is invoked on every rendered expression outside the sandbox's call interception mechanism, achieving remote code execution as the NetBox service user.
AnalysisAI
Remote code execution in NetBox 4.3.5-4.5.4 allows authenticated users with exporttemplate or configtemplate permissions to execute arbitrary Python code as the NetBox service user by injecting malicious callables into Jinja2 template environment parameters. Attackers bypass SandboxedEnvironment protections by setting the finalize parameter to dangerous imports like subprocess.getoutput, which executes on every rendered expression outside sandbox call interception. Public proof-of-concept exploit exists (chocapikk.com), and upstream patch available via GitHub PR #22078 implements an allowlist-based validation mechanism that blocks unauthorized callable resolution at both save-time and render-time.
Technical ContextAI
NetBox is a Python-based infrastructure resource modeling (IPAM/DCIM) application used by network engineers. The vulnerable code exists in the RenderTemplateMixin.get_environment_params() method within the extras module (extras/models/mixins.py), which processes user-controlled environment_params fields for Jinja2 template rendering. The root cause (CWE-183: Permissive List of Allowed Inputs) stems from allowing arbitrary dotted Python paths to be resolved via Django's import_string() utility for Jinja environment parameters like finalize and undefined. While NetBox intended to render templates in a Jinja2 SandboxedEnvironment, the finalize callback parameter is invoked on every template expression result before the sandbox's call interception mechanism activates. By specifying finalize: subprocess.getoutput in the environment_params JSON field, attackers transform every Jinja expression into arbitrary command execution-e.g., {{ "id" }} becomes subprocess.getoutput("id") executed directly on the host. The patch introduces JINJA_ENV_PARAM_IMPORT_ALLOWLIST in extras/constants.py, restricting the undefined parameter to four safe Jinja2 classes and setting the finalize allowlist to an empty frozenset, effectively blocking all callable imports for finalize. Validation occurs both at model save-time (clean() method) and defensively at render-time (get_environment_params()), preventing exploitation of legacy data or direct database writes.
RemediationAI
Upgrade to NetBox version 4.5.5 or later, which includes the patch from GitHub pull request #22078 implementing allowlist-based validation of Jinja2 environment parameters. The fix introduces JINJA_ENV_PARAM_IMPORT_ALLOWLIST that restricts the undefined parameter to four safe Jinja2.Undefined subclasses (jinja2.Undefined, jinja2.ChainableUndefined, jinja2.DebugUndefined, jinja2.StrictUndefined) and sets the finalize allowlist to an empty set, blocking all callable imports for finalize. Validation occurs at both model save-time (clean() method) and render-time (get_environment_params()) for defense-in-depth. Patched code available at https://github.com/netbox-community/netbox/pull/22078. If immediate upgrade is not feasible, implement compensating controls: (1) Audit and restrict exporttemplate and configtemplate Django permissions to only highly trusted administrators-remove these permissions from automation service accounts and junior operators; (2) Review all existing ConfigTemplate and ExportTemplate objects in the database for suspicious environment_params values containing dotted Python paths (SELECT id,name,environment_params FROM extras_configtemplate WHERE environment_params::text LIKE '%finalize%' OR environment_params::text LIKE '%subprocess%'); (3) Deploy web application firewall rules to block POST/PUT/PATCH requests to /api/extras/config-templates/ and /api/extras/export-templates/ endpoints containing environment_params.finalize or environment_params with non-allowlisted import paths; note this breaks legitimate undefined customization and may cause operational disruption. (4) Run NetBox service under a restricted user account with minimal filesystem and network access, and enable mandatory access controls (SELinux, AppArmor) to limit post-exploitation impact; this does NOT prevent RCE but contains lateral movement. No viable workaround fully mitigates the vulnerability without breaking template functionality.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
Cross-user flow execution in Langflow (< 1.9.1) lets any authenticated API-key holder run another user's flow by passing
Same weakness CWE-183 – Permissive List of Allowed Inputs
View allShare
External POC / Exploit Code
Leaving vuln.today