CVE Daily – dbt Core https://cvedaily.com/pages/tags/dbt-core.html CVE Daily – dbt Core en Wed, 03 Jun 2026 21:26:59 +0000 [Medium] CVE-2026-29790 – dbt-common is the shared common utilities for dbt-core and adapter implementatio... https://nvd.nist.gov/vuln/detail/CVE-2026-29790 https://nvd.nist.gov/vuln/detail/CVE-2026-29790 Fri, 06 Mar 2026 21:16:15 +0000 Medium CVE-2026-29790

dbt-common is the shared common utilities for dbt-core and adapter implementations use. Prior to versions 1.34.2 and 1.37.3, a path traversal vulnerability exists in dbt-common's safe_extract() function used when extracting tarball archives. The function uses os.path.commonprefix() to validate that extracted files remain within the intended destination directory. However, commonprefix() compares…

CVSS: 5.3 · CWE: CWE-22

View on NVD

]]> [Medium] CVE-2024-36105 – dbt enables data analysts and engineers to transform their data using the same p... https://nvd.nist.gov/vuln/detail/CVE-2024-36105 https://nvd.nist.gov/vuln/detail/CVE-2024-36105 Mon, 27 May 2024 18:15:10 +0000 Medium CVE-2024-36105

dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. Prior to versions 1.6.15, 1.7.15, and 1.8.1, Binding to `INADDR_ANY (0.0.0.0)` or `IN6ADDR_ANY (::)` exposes an application on all network interfaces, increasing the risk of unauthorized access. As stated in the Python docs, a special form for address is acce…

CVSS: 5.3 · CWE: CWE-1327

View on NVD

]]>