EUVD-2026-82413Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Any user can open a PR (PR:N) with a reliable pickle payload (AC:L); a maintainer/CI must run pytest (UI:R); executing in the runner/host is a scope change (S:C) with full code-execution impact.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
6DescriptionCVE.org
NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. The validation test harness can deserialize pull-request-controlled tracked pickle cache files through pickle.load in the read_pickle_data function in tests/pickle_operations.py. An unauthenticated contributor can change USE_LOCAL_KNOWN_SLUGS in tests/test_configuration.py and supply a crafted tests/known-modules.pickle or tests/known-racks.pickle file that tests/definitions_test.py loads when pytest runs. Deserialization invokes attacker-controlled object reduction behavior, allowing arbitrary code execution in the GitHub Actions runner or in a maintainer process that runs the tests, with the confidentiality, integrity, and availability of reachable resources at risk. This vulnerability is fixed with commit 1c6f7e2b93589b965318c6e67ac3504831f0e71e.
Articles & Coverage 1
AnalysisAI
Arbitrary code execution is possible inside the NetBox Device Type Library's pytest validation harness because the test suite deserializes pull-request-controlled pickle cache files via pickle.load. An unauthenticated contributor can flip USE_LOCAL_KNOWN_SLUGS in tests/test_configuration.py and commit a crafted tests/known-modules.pickle or tests/known-racks.pickle in the same pull request, so the payload fires whenever the tests are run: automatically by the GitHub Actions validation workflow on the PR, or by a maintainer executing pytest locally against the untrusted branch (the user-interaction requirement in the CVSS vector). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the tests/known-modules.pickle or tests/known-racks.pickle cache files to be loaded via pickle.load, which the description states happens when USE_LOCAL_KNOWN_SLUGS is set in tests/test_configuration.py and definitions_test.py runs under pytest - the attacker supplies both the toggle change and the crafted pickle in a single pull request, so no separate misconfiguration is needed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a supply-chain / CI-poisoning vulnerability, not a flaw in deployed NetBox instances, and that distinction dominates the risk picture. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upstream fix available (PR/commit); released patched version not independently confirmed - apply commit 1c6f7e2b93589b965318c6e67ac3504831f0e71e (or later) from pull request 4238, which removes pickle.deserialization from the validation harness, deletes tests/pickle_operations.py and the *.pickle cache files, and replaces them with tests/cache_operations.py reading JSON caches (tests/known-slugs.json, tests/known-modules.json, tests/known-racks.json); forks and downstream mirrors should rebase onto this commit and delete any lingering *.pickle artifacts from their working trees and CI caches. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, stop executing pytest against untrusted pull-request branches: disable or gate the GitHub Actions PR validation workflow behind maintainer approval, and instruct maintainers not to run the suite locally on contributor branches outside a disposable, credential-free sandbox. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution affects Kestra OSS (the open-source event-driven orchestration platform) prior to
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Same weakness CWE-502 – Deserialization of Untrusted Data
View allShare
External POC / Exploit Code
Leaving vuln.today