Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

netbox-community/netbox

              main @ a835fe2
            

158

Fixes

CVEs

CRITICAL

Peak severity

23.1%

Coverage

Highlights

Auth Bypass: 106 prior fixes. Scrutinize any change in this area.

netbox/utilities/views.py: most-fixed (12 issues). Treat as high-risk during review.

56 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: GraphQL lookup queries and schemas historically allowed database querying by primary key without verifying object-level user permissions, potentially exposing all circuit and device records.

Insecure Template Injection: Jinja2 templates compiled for custom links or user configurations were rendered without a SandboxedEnvironment, which permitted arbitrary Python code execution.

Stored XSS: User-supplied Markdown input bypassed link validation regexes, enabling persistent script execution via malicious javascript: URI schemes in rendered links.