CVE-2026-29514
HighSummary
NetBox versions 4.3.5 through 4.5.4 contain a remote code execution vulnerability in the RenderTemplateMixin.get_environment_params() method. It allows authenticated users with exporttemplate or configtemplate permissions to execute arbitrary code by specifying malicious Python callables in the environment_params field.
Risk Assessment
Attackers can bypass Jinja2 SandboxedEnvironment protections, leading to remote code execution as the NetBox service user. This poses a serious threat to the integrity and security of the system.
Recommendation
It is recommended to update NetBox to the latest version to mitigate this vulnerability. Additionally, user permissions should be minimized and logs monitored for potential exploitation attempts.
Other vulnerabilities in NetBox
See all- CVE-2023-33796Critical
A vulnerability in Netbox v3.5.1 allows unauthenticated attackers to execute queries against the GraphQL database, potentially granting access to sensitive data stored in the database.
- CVE-2026-69117Medium
NetBox 4.5.8 contains an ORM injection vulnerability that allows authenticated attackers, including those with read-only API tokens, to inject arbitrary Django ORM lookup expressions into nested object references by supplying crafted JSON dictionary keys in POST, PUT, or PATCH requests to any REST API endpoint. Attackers can exploit the unrestricted queryset used by WritableNestedSerializer to perform boolean-based blind data extraction of sensitive field values and bypass object-level permissions across all application modules including dcim, ipam, tenancy, virtualization, circuits, and extras.
- CVE-2025-69848Medium
NetBox is an open-source infrastructure resource modeling and IP address management platform. A reflected cross-site scripting (XSS) vulnerability exists in versions 2.11.0 through 3.7.x in the ProtectedError handling logic, where object names are included in HTML error messages without proper escaping. This allows user-controlled content to be rendered in the web interface when a delete operation fails due to protected relationships, potentially enabling execution of arbitrary client-side code in the context of a privileged user.
- CVE-2023-37625Medium
In Netbox version 3.4.7, there is a stored XSS vulnerability that allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into Custom Link templates.
- CVE-2023-34565Medium
Netbox version 3.5.1 is vulnerable to Cross Site Scripting (XSS) in the 'Create Wireless LAN Groups' function.
- CVE-2023-33800Medium
Netbox v3.5.1 has a stored XSS vulnerability in the Create Regions (/dcim/regions/) function that allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.
- CVE-2023-33799Medium
A stored cross-site scripting (XSS) vulnerability in the Create Contacts (/tenancy/contacts/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.
- CVE-2023-33798Medium
A stored cross-site scripting (XSS) vulnerability in the Create Rack (/dcim/rack/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.
- CVE-2023-33797Medium
A stored cross-site scripting (XSS) vulnerability in the Create Sites (/dcim/sites/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.
- CVE-2023-33795Medium
A stored XSS vulnerability in the Create Contact Roles function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.
Original NVD description (English source)
NetBox versions 4.3.5 through 4.5.4 contain a remote code execution vulnerability in the RenderTemplateMixin.get_environment_params() method that allows authenticated users with exporttemplate or configtemplate permissions to execute arbitrary code by specifying malicious Python callables in the environment_params field. Attackers can bypass Jinja2 SandboxedEnvironment protections by setting the finalize parameter to any importable Python callable such as subprocess.getoutput, which is invoked on every rendered expression outside the sandbox's call interception mechanism, achieving remote code execution as the NetBox service user.