Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
NetBox versions 4.3.5 through 4.5.4 contain a remote code execution vulnerability in the RenderTemplateMixin.get_environment_params() method that allows authenticated users with exporttemplate or configtemplate permissions to execute arbitrary code by specifying malicious Python callables in the environment_params field. Attackers can bypass Jinja2 SandboxedEnvironment protections by setting the finalize parameter to any importable Python callable such as subprocess.getoutput, which is invoked on every rendered expression outside the sandbox's call interception mechanism, achieving remote code execution as the NetBox service user.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-05-19 | 1 | PoC1 |
| 2026-06-03 | 1 | Disclosure1 |
| 2026-06-13 | 1 | PoC1 |
CVE-2026-29514: NetBox Jinja2 Sandbox Bypass to RCE via RenderTemplateMixin environment_params 👾💥 👨💻 Valentin Lobstein (ʞʞıdɐɔoɥƆ) 🔗 https://chocapikk.com/posts/2026/netbox-export-template-rce/ Join team 👉https://t.me/luckyhacker43 https://t.co/eYHW3tRFrZ
Post summary
This post announces CVE-2026-29514, a NetBox Jinja2 sandbox bypass that enables remote code execution, and links to a proof‑of‑concept demonstrating the vulnerability.
Unpopular opinion: The cybersecurity industry is selling you dashboards. The Sandbox That Never Was: CVE-2026-29514 Turns NetBox Template Engine Into Code Execution
Post summary
The tweet announces CVE-2026-29514, highlighting it enables code execution via the NetBox template engine, but offers no PoC, exploit code, or patch details.
CVE-2026-29514: NetBox Jinja2 Sandbox Bypass to RCE via RenderTemplateMixin environment_params 👾💥 👨💻 Valentin Lobstein (ʞʞıdɐɔoɥƆ) 🔗 https://chocapikk.com/posts/2026/netbox-export-template-rce/ https://t.co/r06iIIm6hV
Post summary
CVE‑2026‑29514 is a NetBox Jinja2 sandbox bypass that results in remote code execution; a proof of concept is provided via the linked blog post, with no mention of patches or active exploitation.