The netbox-community devicetype-library's CI workflow (.github/workflows/validation.yml) previously ran code from pull requests before maintainer review. Specifically, three files editable by contributors—"requirements.txt", ".pre-commit-hooks-config.yaml" / ".pre-commit-yamlfmt-config.yaml", and ".gitmodules"—could be modified to execute arbitrary code on the CI runner. This improper control of code generation (CWE-94) allowed code injection by unprivileged contributors. The vulnerability was addressed by commit f41fc1e, which prevents execution of unreviewed code in the CI process.

An attacker with no special repository access could execute arbitrary code on the CI runner by submitting a pull request that modifies specific configuration files. This could lead to unauthorized code execution within the CI environment, potentially compromising the build infrastructure or leaking sensitive information. The CVSS score of 6.5 indicates a medium severity with low attack complexity and no privileges required.

This vulnerability has been patched by commit f41fc1e, which modifies the CI workflow to prevent execution of code from unreviewed pull requests. Users should update to include this commit or later to mitigate the issue. No additional mitigation steps are required if the patch is applied.