Dashboard / CVE-2026-29514

CVE-2026-29514

HIGH
MEDIUM Priority: 0.07 BB Relevance: 68/100
Published: 2026-05-04 Modified: 2026-11-08 First seen: 2026-11-08 Status: active

Attack Surface

Network Low Complexity No Interaction Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: None
AT: None
VC: High
VI: High
VA: High

Description

NetBox versions 4.3.5 through 4.5.4 contain a remote code execution vulnerability in the RenderTemplateMixin.get_environment_params() method that allows authenticated users with exporttemplate or configtemplate permissions to execute arbitrary code by specifying malicious Python callables in the environment_params field. Attackers can bypass Jinja2 SandboxedEnvironment protections by setting the finalize parameter to any importable Python callable such as subprocess.getoutput, which is invoked on every rendered expression outside the sandbox's call interception mechanism, achieving remote code execution as the NetBox service user.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
netbox-community netbox 4.3.5

References & Advisories (7)

Bug Bounty Relevance

68 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

8.7 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

EPSS — Exploitation Probability

0.78%
Raw Score 0.007820
Percentile 56.5%
Date 2026-11-13

EPSS Trend

2026-11-13
0.00782
2026-11-12
0.00782
2026-11-10
0.00782
2026-11-09
0.00782
2026-11-08
0.00782

Intelligence Sources

mitre ref →

External Links