Vulnerabilidades de Dbt-labs
CVEs publicadas que afetam produtos de Dbt-labs: 3 registro(s), com severidade, exploração e correções.
CVE-2026-100406
Alta · 8.2
CWE-22 14/10/2026
dbt: Unauthenticated Arbitrary SQL Execution in `dbt docs serve`
dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. From 2.0.0-alpha.0 until 2.0.0-alpha.5, dbt docs serve exposes the unauthenticated POST /api/v1/query endpoint in crates/dbt-docs-server/src/handlers/query.rs, which passes caller-supplied SQL to DuckDbViewsBackend::query_arrow() in crates/dbt-index-core/src/backend.rs without authorization or an allowlist. A client that can reach the server can invoke DuckDB filesystem-reading functions to read files available to the dbt process, including files outside the docs index directory. The server binds to localhost by default, but operators can expose it to a network through the host option or DBT_DOCS_HOST setting. This issue is fixed in version 2.0.0-alpha.5.
CVE-2026-39382
Crítica · 9.3
CWE-78 07/04/2026
Workflow reutilizável do dbt-labs: injeção de comandos de SO via corpo de comentário
dbt permite que analistas e engenheiros de dados transformem seus dados usando as mesmas práticas que engenheiros de software usam para construir aplicações. No workflow reutilizável dbt-labs/actions/blob/main/.github/workflows/open-issue-in-repo.yml, o job prep usa peter-evans/find-comment para procurar um comentário existente indicando que uma issue de documentação já foi aberta. A saída steps.issue_comment.outputs.comment-body é então interpolada diretamente em uma instrução if do bash. Como comment-body é um texto controlado por atacante e é inserido na sintaxe do shell sem escape, um corpo de comentário malicioso pode sair da string entre aspas e injetar comandos de shell arbitrários. Esta vulnerabilidade é corrigida com o commit bbed8d28354e9c644c5a7df13946a3a0451f9ab9.
CVE-2026-29790
Média · 5.3
CWE-22 06/03/2026
dbt-common: commonprefix() doesn't protect against path traversal
dbt-common is the shared common utilities for dbt-core and adapter implementations use. Prior to versions 1.34.2 and 1.37.3, a path traversal vulnerability exists in dbt-common's safe_extract() function used when extracting tarball archives. The function uses os.path.commonprefix() to validate that extracted files remain within the intended destination directory. However, commonprefix() compares paths character-by-character rather than by path components, allowing a malicious tarball to write files to sibling directories with matching name prefixes. This issue has been patched in versions 1.34.2 and 1.37.3.