CVE Intelligence
Analysis AI-assisted

CVE-2026-39382: dbt-labs reusable workflow: OS command injection via comment body

A critical OS command injection flaw (CWE-78) in a dbt-labs reusable GitHub Actions workflow lets attacker-controlled comment text reach a bash if statement. The CNA reports a CVSS 4.0 score of 9.3, and the record states the issue is fixed by commit bbed8d28354e9c644c5a7df13946a3a0451f9ab9. No confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

The record describes an OS command injection flaw (CWE-78) in the reusable workflow open-issue-in-repo.yml from the dbt-labs/actions repository. In the prep job, a comment body found by peter-evans/find-comment is interpolated into a bash if statement without escaping. The record states the fix is commit bbed8d28354e9c644c5a7df13946a3a0451f9ab9.

Impact

  • The CVSS 4.0 vector supplied by the CNA (score 9.3, critical) describes network attack, low complexity, no privileges and no user interaction, with high impact on confidentiality, integrity and availability of the vulnerable system.
  • The record states that a crafted comment body could break out of the quoted string and run arbitrary shell commands.
  • Real-world consequences depend on the permissions and secrets available to the affected job, which the record does not describe.

Affected products and versions

  • Component named in the record: the reusable workflow dbt-labs/actions/.github/workflows/open-issue-in-repo.yml, prep job.
  • The record does not list affected or fixed version ranges. The affected and fixes lists are empty.
  • The advisory GHSA-5jxf-vmqr-5g82 is linked from the dbt-core repository. The record does not explain how it relates to this workflow.

Exploitation status

  • The KEV flag is false. No confirmed exploitation appears in the sources consulted for this analysis.
  • The EPSS probability is 0.00461 with percentile 0.38215 as recorded. This is a statistical estimate, not evidence of exploitation.

Remediation and mitigation

  • Review commit bbed8d28354e9c644c5a7df13946a3a0451f9ab9 and make sure any copy of the workflow you use includes it.
  • If you call the workflow by reference, pin it to a reviewed commit SHA and update it deliberately.
  • Until the change is in place, review workflows that place step outputs or comment content into shell logic, and limit token permissions and secrets available to jobs triggered by comments.

Detection guidance

  • Search workflow files for step outputs or event fields inserted directly into run blocks, especially inside conditional statements.
  • Review run logs of jobs triggered by issue or comment events for unexpected commands or output.
  • Check repository audit logs for unexpected changes to workflow files.

Limitations of the available information

  • The record contains no affected version ranges, fixed release tags or technical exploit details, and this analysis adds none.
  • It is unknown who can post the comments that reach this code path in a given deployment.
  • The record's source_status is Deferred, and its meaning is not explained.

Frequently asked questions

What is the core problem in CVE-2026-39382?

A comment body obtained by a workflow step is inserted into a bash if statement without escaping, so attacker-controlled text can break out of the quoted string and inject shell commands.

Is there a confirmed fix?

The record states the issue is fixed by commit bbed8d28354e9c644c5a7df13946a3a0451f9ab9. The record does not list fixed release versions, so check the commit and your copy of the workflow.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.