Dbt-Labs Dbt-Common vulnerabilities

1 known vulnerability affecting dbt-labs/dbt-common.

Total CVEs

1

CISA KEV

0

Public exploits

0

Exploited in wild

0

Severity breakdown

LOW1

Vulnerabilities

Page 1 of 1

CVE-2026-29790LOWCVSS 2.0fixed in 1.37.3fixed in 1.34.22026-03-06

CVE-2026-29790 [LOW] CWE-22 CVE-2026-29790: dbt-common is the shared common utilities for dbt-core and adapter implementations use. Prior to ver dbt-common is the shared common utilities for dbt-core and adapter implementations use. Prior to versions 1.34.2 and 1.37.3, a path traversal vulnerability exists in dbt-common's safe_extract() function used when extracting tarball archives. The function uses os.path.commonprefix() to validate that extracted files remain within the intended destination