The netbox-community devicetype-library contains a deserialization of untrusted data vulnerability (CWE-502) in its test validation harness. Specifically, the read_pickle_data function in tests/pickle_operations.py uses pickle.load on pull-request-controlled tracked pickle cache files. An unauthenticated contributor can modify the USE_LOCAL_KNOWN_SLUGS flag and supply malicious tests/known-modules.pickle or tests/known-racks.pickle files. When pytest runs, tests/definitions_test.py loads these files, triggering deserialization of attacker-controlled objects. This allows arbitrary code execution in the context of the GitHub Actions runner or maintainer processes executing the tests, impacting confidentiality, integrity, and availability. The issue is resolved by commit 1c6f7e2b93589b965318c6e67ac3504831f0e71e.

Successful exploitation leads to arbitrary code execution in the environment running the tests, such as GitHub Actions runners or maintainer machines. This compromises confidentiality, integrity, and availability of affected systems and resources.

A fix is available and has been applied in commit 1c6f7e2b93589b965318c6e67ac3504831f0e71e. Users and maintainers should update to the fixed version incorporating this commit to remediate the vulnerability. Until patched, avoid running untrusted pull requests in environments where code execution could cause harm.