CVE-2024-40637mediumCWE-74

CVE-2024-40637: medium-severity vulnerability in dbt-labs dbt-core

Implicit override for built-in materializations from installed packages in dbt-core

Published · Updated

Follow this CVE+ Monitor dbt-core+ Monitor dbt-core

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 4.2epss 0.4%
dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. When a user installs a package in dbt, it has the ability to override macros, materializations, and other core components of dbt. This is by design, as it allows packages to extend and customize dbt's functionality. However, this also means that a malicious package could potentially override these components with harmful code. This issue has been fixed in versions 1.8.0, 1.6.14 and 1.7.14. Users are advised to upgrade. There are no kn own workarounds for this vulnerability. Users updating to either 1.6.14 or 1.7.14 will need to set `flags.require_explicit_package_overrides_for_builtin_materializations: False` in their configuration in `dbt_project.yml`.
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L
Affected products
dbt-labs · dbt-core
Related CVEs — dbt-labs dbt-core

In the same product, most dangerous first.

CVE-2024-36105MEDIUMdbt allows Binding to an Unrestricted IP Address via socketsocketEPSS 0.7%CVE-2026-100406HIGHdbt: Unauthenticated Arbitrary SQL Execution in `dbt docs serve`EPSS 0.4%CVE-2026-39382CRITICALdbt has a Command Injection in Reusable Workflow via Unsanitized comment-body OutputEPSS 0.4%