CVE-2026-29514 NetBox 4.3.5 - 4.5.4 RCE via RenderTemplateMixin
Authenticated users with template permissions can execute arbitrary code by injecting malicious Python callables into environment parameters, bypassing sandbox restrictions.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-29514?
CVE-2026-29514 is a high-severity code injection vulnerability in netbox-community netbox, published on 4 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
NetBox versions 4.3.5 through 4.5.4 contain a remote code execution vulnerability in the RenderTemplateMixin.get_environment_params() method that allows authenticated users with exporttemplate or configtemplate permissions to execute arbitrary code by specifying malicious Python callables in the environment_params field. Attackers can bypass Jinja2 SandboxedEnvironment protections by setting the finalize parameter to any importable Python callable such as subprocess.getoutput, which is invoked on every rendered expression outside the sandbox's call interception mechanism, achieving remote code execution as the NetBox service user.
Weakness: CWE-183
Which versions are affected by CVE-2026-29514?
How do I fix CVE-2026-29514?
No fix has been published for CVE-2026-29514 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-29514 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-29514 exists.
Sources
Also known as GHSA-f249-4qx6-hg68.