Vulnerabilities in dbt-labs

7 results

Vexday analysis

A dbt-labs apresenta 7 vulnerabilidades catalogadas, com 3 publicadas nos últimos 90 dias, indicando atividade recente de descobertas. Nenhuma vulnerabilidade está sob exploração ativa (KEV), e apenas 1 atinge nível crítico, sugerindo risco moderado no curto prazo. A fraqueza dominante (CWE-1327) aponta para problemas de validação ou controle de qualidade no código.

CVE-2024-36105MEDIUMdbt allows Binding to an Unrestricted IP Address via socketsocketEPSS 0.7%CVE-2026-39382CRITICALdbt has a Command Injection in Reusable Workflow via Unsanitized comment-body OutputEPSS 0.4%CVE-2024-40637MEDIUMImplicit override for built-in materializations from installed packages in dbt-coreEPSS 0.4%CVE-2026-29790LOWdbt-common: commonprefix() doesn't protect against path traversalEPSS 0.3%CVE-2026-44970LOWdbt-mcp: All MCP Tool Arguments Including Raw SQL and --vars Credentials Transmitted to dbt Labs Telemetry by Default Without RedactionEPSS 0.2%CVE-2026-44968MEDIUMdbt-mcp: Argument Injection in dbt CLI Tool Wrappers via node_selection and resource_type ParametersEPSS 0.2%CVE-2026-44969LOWdbt-mcp: Tool Arguments Including SQL Queries and Credentials Logged in Plaintext Without Redaction When File Logging Is EnabledEPSS 0.1%