CVE-2023-36830

SQLFluff is a SQL linter. Prior to version 2.1.2, in environments where untrusted users have access to the config files, there is a potential security vulnerability where those users could use the librarypath config value to allow arbitrary python code to be executed via macros. For many users wh...

alvin-cli (0.0.1a0) potentially affected by CVE-2023-36830 via sqlfluff (0.12.0)

sqlfluff PYPI version 0.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - alvin-cli 0.0.1a0 Source cves: CVE-2023-36830 Source advisory: OSV:GHSA-JQHC-M2J3-FJRX...

dbt-coves (>=0.21.0a18, <=0.21.1a20) potentially affected by CVE-2023-36830 via sqlfluff (0.9.4)

sqlfluff PYPI version 0.9.4 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - dbt-coves =0.21.0a18, =0.21.1a20 Source cves: CVE-2023-36830 Source advisory: OSV:GHSA-JQHC-M2J3-FJRX...

dbt-coves (0.21.0a17) potentially affected by CVE-2023-36830 via sqlfluff (0.9.3)

sqlfluff PYPI version 0.9.3 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - dbt-coves 0.21.0a17 Source cves: CVE-2023-36830 Source advisory: OSV:GHSA-JQHC-M2J3-FJRX...

sqlfluff-templater-dbt (1.3.2) potentially affected by CVE-2023-36830 via sqlfluff (1.3.2)

sqlfluff PYPI version 1.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - sqlfluff-templater-dbt 1.3.2 Source cves: CVE-2023-36830 Source advisory: OSV:GHSA-JQHC-M2J3-FJRX...

CVE-2023-36830

creationtimestamp| type| source ---|---|--- 2023-07-06 20:20:31+00:00| seen| https://t.me/cibsecurity/66142...

CVE-2023-36830

SQLFluff is a SQL linter. Prior to version 2.1.2, in environments where untrusted users have access to the config files, there is a potential security vulnerability where those users could use the librarypath config value to allow arbitrary python code to be executed via macros. For many users wh...

sqlfluff-templater-dbt (1.3.2) potentially affected by CVE-2023-36830 via sqlfluff (1.3.2)

sqlfluff PYPI version 1.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - sqlfluff-templater-dbt 1.3.2 Source cves: CVE-2023-36830 Source advisory: OSV:PYSEC-2023-111...

sqlfluff-templater-dbt (1.3.1) potentially affected by CVE-2023-36830 via sqlfluff (1.3.1)

sqlfluff PYPI version 1.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - sqlfluff-templater-dbt 1.3.1 Source cves: CVE-2023-36830 Source advisory: OSV:PYSEC-2023-111...

sqlfluff-templater-dbt (1.3.0) potentially affected by CVE-2023-36830 via sqlfluff (1.3.0)

sqlfluff PYPI version 1.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - sqlfluff-templater-dbt 1.3.0 Source cves: CVE-2023-36830 Source advisory: OSV:PYSEC-2023-111...

alvin-cli (>=0.2.0, <=1.2.0rc14) potentially affected by CVE-2023-36830 via sqlfluff (0.13.0)

sqlfluff PYPI version 0.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - alvin-cli =0.2.0, =1.2.0rc14 Source cves: CVE-2023-36830 Source advisory: OSV:PYSEC-2023-111...

CVE-2023-36830

CVE-2023-36830 affects SQLFluff prior to v2.1.2 where an attacker with access to config files could abuse the library_path setting to execute arbitrary Python code via Jinja/macros. The issue arises when untrusted users can view or modify config and leverage library_path to reach Python execution...

CVE-2023-36830

SQLFluff is a SQL linter. Prior to version 2.1.2, in environments where untrusted users have access to the config files, there is a potential security vulnerability where those users could use the librarypath config value to allow arbitrary python code to be executed via macros. For many users wh...