CVE-2026-55251: NetBox Device Type Library CI RCE Vulnerability

CVE-2026-55251 Overview

CVE-2026-55251 affects the NetBox Device Type Library, a community-sourced collection of device type definitions imported into NetBox. The vulnerability resides in the .github/workflows/validation.yml continuous integration workflow, which runs on pull_request events and executes contributor-supplied code before maintainer review. Three pull-request-editable files drive the issue: requirements.txt, .pre-commit-hooks-config.yaml / .pre-commit-yamlfmt-config.yaml, and .gitmodules. A contributor without special repository access could open a pull request modifying these files and execute arbitrary code on the CI runner. Maintainers patched the issue in commit f41fc1e.

Critical Impact
Any GitHub user able to open a pull request could execute arbitrary code inside the project's CI runner, exposing workflow secrets and build integrity.

Affected Products

NetBox Device Type Library repository prior to commit f41fc1e
CI pipelines using .github/workflows/validation.yml with pull_request triggers
Downstream forks that reuse the unpatched validation workflow

Discovery Timeline

2026-10-01 - CVE-2026-55251 published to the National Vulnerability Database
2026-10-05 - Last updated in NVD database

Technical Details for CVE-2026-55251

Vulnerability Analysis

The vulnerability is a code injection flaw [CWE-94] in a GitHub Actions workflow. The validation.yml workflow runs when a pull request is opened and performs steps that install dependencies and run pre-commit hooks. Because the workflow checks out the pull request branch and then invokes pip install -r requirements.txt, pre-commit hook configurations, and git submodule operations, any attacker-controlled content in those files executes during the CI job. An external contributor can therefore influence the CI runner environment without maintainer approval.

Root Cause

The root cause is trusting pull-request-supplied content in files that drive code execution during CI. The pull_request trigger runs the workflow definition from the base branch, but the installed dependencies and hook definitions come from the attacker's branch. Without CODEOWNERS enforcement or pull_request_target guardrails, these files bypass maintainer review before executing.

Attack Vector

An unauthenticated external contributor forks the repository, modifies requirements.txt to reference a malicious package, alters .pre-commit-hooks-config.yaml or .pre-commit-yamlfmt-config.yaml to invoke arbitrary shell commands, or edits .gitmodules to point to an attacker-controlled submodule. Opening a pull request triggers validation.yml, which then executes the attacker's payload on the GitHub-hosted runner with access to any secrets or tokens scoped to that workflow.

text

# Patch excerpt from commit f41fc1e — .github/CODEOWNERS
# Files whose changes execute in CI / control test collection require maintainer review.
-/tests/                     @danner26
-/.github/                   @danner26
-/pytest.ini                 @danner26
-/.pre-commit-config.yaml    @danner26
+/tests/                             @danner26
+/.github/                           @danner26
+/pytest.ini                         @danner26
+/.pre-commit-config.yaml            @danner26
+# Files that pip-install / pre-commit / submodule-checkout untrusted code in CI.
+/requirements.txt                   @danner26
+/.gitmodules                        @danner26
+/.pre-commit-hooks-config.yaml      @danner26
+/.pre-commit-yamlfmt-config.yaml    @danner26

Source: GitHub Commit f41fc1e. The fix extends CODEOWNERS so that modifications to the dependency and hook files require maintainer review before CI executes them.

Detection Methods for CVE-2026-55251

Indicators of Compromise

Pull requests from first-time contributors that modify requirements.txt, .pre-commit-hooks-config.yaml, .pre-commit-yamlfmt-config.yaml, or .gitmodules.
CI workflow runs showing outbound network connections to unexpected hosts or installations of unknown PyPI packages.
Submodule URLs in .gitmodules pointing to repositories outside the netbox-community organization.

Detection Strategies

Audit GitHub Actions run logs for pip install output listing packages not present in prior builds.
Compare pull request diffs against a baseline list of sensitive files and flag any contributor modifications for manual review.
Review pre-commit hook invocations for shell commands or scripts not defined upstream.

Monitoring Recommendations

Enable GitHub branch protection and require CODEOWNERS approval on dependency and workflow configuration files.
Forward GitHub Actions audit logs to a SIEM for correlation of workflow executions with external contributor identity.
Monitor the organization's package registry for publication of new or unexpected artifacts following CI runs.

How to Mitigate CVE-2026-55251

Immediate Actions Required

Update the NetBox Device Type Library repository to include commit f41fc1e or any later commit that preserves the expanded CODEOWNERS entries.
Rotate any secrets, tokens, or deploy keys that were accessible to the validation.yml workflow prior to the patch.
Review historical pull requests that modified requirements.txt, .pre-commit-hooks-config.yaml, .pre-commit-yamlfmt-config.yaml, or .gitmodules for signs of abuse.

Patch Information

The maintainers resolved the issue in commit f41fc1e by adding the four CI-sensitive files to .github/CODEOWNERS, requiring maintainer review before any pull request change to those files can execute in CI. Full details are in the GitHub Security Advisory GHSA-5x2m-x42f-g4cm and the patch commit.

Workarounds

Restrict the validation.yml workflow to run only after a maintainer applies an approval label, using the pull_request_target pattern with explicit checkout controls.
Require all first-time contributor workflow runs to be manually approved via the GitHub repository setting "Require approval for all outside collaborators."
Pin dependencies in requirements.txt using hashes and disable submodule checkout in CI unless strictly required.

bash

# Example: enforce CODEOWNERS review on sensitive CI files
cat >> .github/CODEOWNERS <<'EOF'
/requirements.txt                   @maintainer
/.gitmodules                        @maintainer
/.pre-commit-hooks-config.yaml      @maintainer
/.pre-commit-yamlfmt-config.yaml    @maintainer
EOF

# Require code owner review in branch protection
gh api -X PUT repos/:owner/:repo/branches/main/protection/required_pull_request_reviews \
  -f require_code_owner_reviews=true