CVE-2026-54752 Deserialization in devicetype-library
An attacker can achieve remote code execution in CI runners or maintainer environments by submitting malicious pickle files to the NetBox Device Type Library test suite.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-54752?
CVE-2026-54752 is a critical unsafe deserialization vulnerability in netbox-community devicetype-library, published on 17 Sep 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. The validation test harness can deserialize pull-request-controlled tracked pickle cache files through pickle.load in the read_pickle_data function in tests/pickle_operations.py. An unauthenticated contributor can change USE_LOCAL_KNOWN_SLUGS in tests/test_configuration.py and supply a crafted tests/known-modules.pickle or tests/known-racks.pickle file that tests/definitions_test.py loads when pytest runs. Deserialization invokes attacker-controlled object reduction behavior, allowing arbitrary code execution in the GitHub Actions runner or in a maintainer process that runs the tests, with the confidentiality, integrity, and availability of reachable resources at risk. This vulnerability is fixed with commit 1c6f7e2b93589b965318c6e67ac3504831f0e71e.
Which versions are affected by CVE-2026-54752?
How do I fix CVE-2026-54752?
No fix has been published for CVE-2026-54752 yet. Limit exposure of the affected software until one is available.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2026-54752 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-54752 exists.
Sources
Also known as GHSA-492p-5wp7-2w7c.