CVE-2026-29514

The record

NetBox versions 4.3.5 through 4.5.4 contain a remote code execution vulnerability in the RenderTemplateMixin.get_environment_params() method that allows authenticated users with exporttemplate or configtemplate permissions to execute arbitrary code by specifying malicious Python callables in the environment_params field. Attackers can bypass Jinja2 SandboxedEnvironment protections by setting the finalize parameter to any importable Python callable such as subprocess.getoutput, which is invoked on every rendered expression outside the sandbox's call interception mechanism, achieving remote code execution as the NetBox service user.

Affected packages

Related vulnerabilities

• CVE-2026-113786 pypdf is a free and open-source pure-python PDF library. CWE-183
• CVE-2026-54694 SkillTree is a micro-learning gamification platform. CWE-183
• CVE-2026-55581 mcp-shell is an MCP server for running shell commands securely, auditably, and on demand. CWE-183
• CVE-2026-63649 The Windows interactive service in OpenVPN 2.4.0 through 2.6.21 and 2.7_alpha1 through… CWE-183
• CVE-2026-67315 axios versions 0.31.0 before 0.33.0 and 1.15.0 before 1.18.0 fail to recognize 0.0.0.0 as… CWE-183
• CVE-2026-46608 Glances is an open-source system cross-platform monitoring tool. CWE-183
• CVE-2026-50189 Appsmith is a platform to build admin panels, internal tools, and dashboards. CWE-183
• CVE-2026-54316 Claude Code is an agentic coding tool. CWE-183