Netbox-community vulnerabilities
We track 5 vulnerabilities in Netbox-community products across 3 products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on October 6, 2026.
Latest Netbox-community vulnerabilities
- 7.6 High severity
netbox: Improper Neutralization of Input During Web Page Generation
NetBox versions 2.9.5 before 4.7.0 contain a server-side template injection vulnerability that allows a low-privileged user with the "Can add custom links" permission to steal session cookies and API tokens of other users by exposing the raw Django HttpRequest
- 8.8 High severity
devicetype-library: Uncontrolled Search Path Element
NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. The absence of tests/init.py and the lack of --import-mode=importlib cause pytest prepend import mode to place the tests directory at the front of s
- 9.6 Critical severity
devicetype-library: Deserialization of Untrusted Data
NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. The validation test harness can deserialize pull-request-controlled tracked pickle cache files through pickle.load in the read_pickle_data function
- 8.8 High severity
netbox: Permissive List of Allowed Inputs
NetBox versions 4.3.5 through 4.5.4 contain a remote code execution vulnerability in the RenderTemplateMixin.get_environment_params() method that allows authenticated users with exporttemplate or configtemplate permissions to execute arbitrary code by specifyi
- 9.8 Critical severity
netbox-docker: Use of Hard-coded Credentials
netbox-docker before 2.5.0 has a superuser account with default credentials (admin password for the admin account, and 0123456789abcdef0123456789abcdef01234567 value for SUPERUSER_API_TOKEN). In practice on the public Internet, almost all users changed the pas