CVE-2026-54752
CRITICALDescription
NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. The validation test harness can deserialize pull-request-controlled tracked pickle cache files through pickle.load in the read_pickle_data function in tests/pickle_operations.py. An unauthenticated contributor can change USE_LOCAL_KNOWN_SLUGS in tests/test_configuration.py and supply a crafted tests/known-modules.pickle or tests/known-racks.pickle file that tests/definitions_test.py loads when pytest runs. Deserialization invokes attacker-controlled object reduction behavior, allowing arbitrary code execution in the GitHub Actions runner or in a maintainer process that runs the tests, with the confidentiality, integrity, and availability of reachable resources at risk. This vulnerability is fixed with commit 1c6f7e2b93589b965318c6e67ac3504831f0e71e.
How to fix
No published remediation has been found for this vulnerability's affected products yet.
Mitigation guidance may be in the linked vendor advisories in the References section below.
TridentStack Control tracks known vulnerabilities across your Windows, macOS, and Linux fleet and shows the fix as soon as one is published. See how it works
CVSS v3 Vector
Exploitability
Impact
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Exploit Intelligence
EPSS data unavailable for this CVE.
References
Related Vulnerabilities
Other CWE-502 (Deserialization of Untrusted Data) vulnerabilities, ordered by exploit likelihood. View all
| CVE | Severity | CVSS | EPSS | Exploited | Fix |
|---|---|---|---|---|---|
| CVE-2023-0669 | High | 7.2 | 100% | KEV + Ransom | Fix |
| CVE-2021-44228 | Critical | 10.0 | 100% | KEV + Ransom | Fix |
| CVE-2021-35464 | Critical | 9.8 | 100% | KEV + Ransom | Fix |
| CVE-2025-53770 | Critical | 9.8 | 100% | KEV + Ransom | Fix |
| CVE-2023-29300 | Critical | 9.8 | 100% | KEV + Ransom | - |
| CVE-2025-59287 | Critical | 9.8 | 100% | KEV | Fix |
Common questions
How do I fix CVE-2026-54752?
No published fix for CVE-2026-54752 has been found yet. Check the linked vendor advisories for guidance as it becomes available.
How severe is CVE-2026-54752?
CVE-2026-54752 has a CVSS v3 base score of 9.6, rated critical. CVSS rates the technical impact if the vulnerability is exploited, not how likely that is, so weigh it alongside the exploit-prediction score when you decide what to patch first.
Embed a live status badge for CVE-2026-54752
Markdown
[](https://tridentstack.com/cve/CVE-2026-54752)HTML
<a href="https://tridentstack.com/cve/CVE-2026-54752"><img src="https://tridentstack.com/cve/badge/CVE-2026-54752.svg" alt="CVE-2026-54752"></a>Find and fix vulnerabilities across your fleet
TridentStack Control continuously scans your Windows, macOS, and Linux fleet for known vulnerabilities, prioritizes them by severity and active exploitation, and patches them automatically.
This product uses NVD data but is not endorsed or certified by the NVD. EPSS scores courtesy of FIRST.org (https://www.first.org/epss). Source: CISA KEV Catalog. Data as of 2026-09-17.