sqlfluff-plugin-sparksql-upgrade (>=0.1.3, <=0.1.4), sqlfluff-templater-dbt (2.3.2) potentially affected by CVE-2026-46373 via sqlfluff (2.3.2)

sqlfluff PYPI version 2.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - sqlfluff-plugin-sparksql-upgrade =0.1.3, =0.1.4 - sqlfluff-templater-dbt 2.3.2 Source cves: CVE-2026-46373 Source advisory: OSV:GHSA-WMHF-FQC8-V...

sqlfluff-templater-dbt (3.0.4) potentially affected by CVE-2026-46373 via sqlfluff (3.0.4)

sqlfluff PYPI version 3.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - sqlfluff-templater-dbt 3.0.4 Source cves: CVE-2026-46373 Source advisory: OSV:GHSA-WMHF-FQC8-VXHH...

sqlfluff-templater-dbt (3.1.0) potentially affected by CVE-2026-46373 via sqlfluff (3.1.0)

sqlfluff PYPI version 3.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - sqlfluff-templater-dbt 3.1.0 Source cves: CVE-2026-46373 Source advisory: OSV:GHSA-WMHF-FQC8-VXHH...

data-designer (>=0.2.2, <=0.6.0), data-designer-engine (>=0.4.0rc1, <=0.6.0) +4 more potentially affected by CVE-2026-46373 via sqlfluff (3.4.0)

sqlfluff PYPI version 3.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - data-designer =0.2.2, =0.4.0rc1, =0.4.27, =0.1.0, =0.2.0 - sqlfluff-templater-dataform 0.1.6 - sqlfluff-templater-dbt 3.4.0 Source cves:...

alvin-cli (0.0.1a0) potentially affected by CVE-2026-46373 via sqlfluff (0.12.0)

sqlfluff PYPI version 0.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - alvin-cli 0.0.1a0 Source cves: CVE-2026-46373 Source advisory: OSV:GHSA-WMHF-FQC8-VXHH...

sqlfluff-templater-dbt (3.0.0a4) potentially affected by CVE-2026-46373 via sqlfluff (3.0.0a4)

sqlfluff PYPI version 3.0.0a4 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - sqlfluff-templater-dbt 3.0.0a4 Source cves: CVE-2026-46373 Source advisory: OSV:GHSA-WMHF-FQC8-VXHH...

sqlfluff-templater-dbt (3.0.0a6) potentially affected by CVE-2026-46373 via sqlfluff (3.0.0a6)

sqlfluff PYPI version 3.0.0a6 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - sqlfluff-templater-dbt 3.0.0a6 Source cves: CVE-2026-46373 Source advisory: OSV:GHSA-WMHF-FQC8-VXHH...

EUVD-2023-0242

Malicious code in bioql PyPI...

CVE-2023-36830

SQLFluff is a SQL linter. Prior to version 2.1.2, in environments where untrusted users have access to the config files, there is a potential security vulnerability where those users could use the librarypath config value to allow arbitrary python code to be executed via macros. For many users wh...

Linux Distros Unpatched Vulnerability : CVE-2023-36830

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - SQLFluff is a SQL linter. Prior to version 2.1.2, in environments where untrusted users have access to the config files, there is a potential security...

Arbitrary Code Execution

sqlfluff is vulnerable to Arbitrary Code Execution. The vulnerability exists because the extractlibrariesfromconfig function of jinja.py does not properly enable the CLI option to override the librarypath option in the template, allowing an attacker with access to the config file to inject and...

alvin-cli (0.0.1a0) potentially affected by CVE-2023-36830 via sqlfluff (0.12.0)

sqlfluff PYPI version 0.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - alvin-cli 0.0.1a0 Source cves: CVE-2023-36830 Source advisory: OSV:GHSA-JQHC-M2J3-FJRX...

sqlfluff-templater-dbt (1.2.1) potentially affected by CVE-2023-36830 via sqlfluff (1.2.1)

sqlfluff PYPI version 1.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - sqlfluff-templater-dbt 1.2.1 Source cves: CVE-2023-36830 Source advisory: OSV:GHSA-JQHC-M2J3-FJRX...

dbt-coves (0.21.0a17) potentially affected by CVE-2023-36830 via sqlfluff (0.9.3)

sqlfluff PYPI version 0.9.3 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - dbt-coves 0.21.0a17 Source cves: CVE-2023-36830 Source advisory: OSV:GHSA-JQHC-M2J3-FJRX...

dbt-osmosis (>=0.9.3, <=0.10.0), dbt-superset-lineage (>=0.3.0, <=0.3.2) +3 more potentially affected by CVE-2023-36830 via sqlfluff (1.4.5)

sqlfluff PYPI version 1.4.5 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - dbt-osmosis =0.9.3, =0.3.0, =0.8.0, =0.0.0, =0.0.1 - sqlfluff-templater-dbt 1.4.5 Source cves: CVE-2023-36830 Source advisory:...

alvin-cli (>=1.1.9, <=1.2.0), cumulus-library (>=0.1.2, <=1.4.0) +6 more potentially affected by CVE-2023-36830 via sqlfluff (>=2.0.0a1, <=2.1.1)

sqlfluff PYPI version =2.0.0a1, =1.1.9, =0.1.2, =0.1.2, =0.13.2.6, =1.0.2, =2.0.0a1, =1.4.2, =0.1.0, =0.1.1 Source cves: CVE-2023-36830 Source advisory: GHSA-JQHC-M2J3-FJRX...

dbt-coves (>=0.21.0a18, <=0.21.1a20) potentially affected by CVE-2023-36830 via sqlfluff (0.9.4)

sqlfluff PYPI version 0.9.4 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - dbt-coves =0.21.0a18, =0.21.1a20 Source cves: CVE-2023-36830 Source advisory: OSV:GHSA-JQHC-M2J3-FJRX...

sqlfluff-templater-dbt (1.3.1) potentially affected by CVE-2023-36830 via sqlfluff (1.3.1)

sqlfluff PYPI version 1.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - sqlfluff-templater-dbt 1.3.1 Source cves: CVE-2023-36830 Source advisory: OSV:GHSA-JQHC-M2J3-FJRX...

alvin-cli (>=0.2.0, <=1.2.0rc14) potentially affected by CVE-2023-36830 via sqlfluff (0.13.0)

sqlfluff PYPI version 0.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - alvin-cli =0.2.0, =1.2.0rc14 Source cves: CVE-2023-36830 Source advisory: OSV:GHSA-JQHC-M2J3-FJRX...

sqlfluff-templater-dbt (1.3.2) potentially affected by CVE-2023-36830 via sqlfluff (1.3.2)

sqlfluff PYPI version 1.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - sqlfluff-templater-dbt 1.3.2 Source cves: CVE-2023-36830 Source advisory: OSV:GHSA-JQHC-M2J3-FJRX...