dbt-coves (>=1.0.4a27, <=1.1.1a0) potentially affected by CVE-2026-46373 via sqlfluff (0.11.2)

sqlfluff PYPI version 0.11.2 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - dbt-coves =1.0.4a27, =1.1.1a0 Source cves: CVE-2026-46373 Source advisory: OSV:GHSA-WMHF-FQC8-VXHH...

cdbt (>=0.4.10, <=0.4.13), sqlfluff-templater-dataform (0.1.4) +1 more potentially affected by CVE-2026-46373 via sqlfluff (3.2.5)

sqlfluff PYPI version 3.2.5 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - cdbt =0.4.10, =0.4.13 - sqlfluff-templater-dataform 0.1.4 - sqlfluff-templater-dbt 3.2.5 Source cves: CVE-2026-46373 Source advisory:...

cdbt (>=0.4.14, <=0.4.26), sqlfluff-templater-dataform (0.1.5) +1 more potentially affected by CVE-2026-46373 via sqlfluff (3.3.0)

sqlfluff PYPI version 3.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - cdbt =0.4.14, =0.4.26 - sqlfluff-templater-dataform 0.1.5 - sqlfluff-templater-dbt 3.3.0 Source cves: CVE-2026-46373 Source advisory:...

data-designer (>=0.2.2, <=0.6.0), data-designer-engine (>=0.4.0rc1, <=0.6.0) +4 more potentially affected by CVE-2026-46373 via sqlfluff (3.4.0)

sqlfluff PYPI version 3.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - data-designer =0.2.2, =0.4.0rc1, =0.4.27, =0.1.0, =0.2.0 - sqlfluff-templater-dataform 0.1.6 - sqlfluff-templater-dbt 3.4.0 Source cves:...

sqlfluff-templater-dbt (3.4.2) potentially affected by CVE-2026-46373 via sqlfluff (3.4.2)

sqlfluff PYPI version 3.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - sqlfluff-templater-dbt 3.4.2 Source cves: CVE-2026-46373 Source advisory: OSV:GHSA-WMHF-FQC8-VXHH...

cumulus-library-kidney-transplant (>=0.2.0, <=0.3.0), dbt-exasol (>=1.10.0, <=1.10.1) +10 more potentially affected by CVE-2026-46373 via sqlfluff (3.5.0)

sqlfluff PYPI version 3.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - cumulus-library-kidney-transplant =0.2.0, =1.10.0, =0.9.0a0, =0.4.36, =0.1.2, =1.3.0, =0.10.0, =1.0.0, =0.1.0, =0.3.1 -...

sqlfluff-templater-dataform (>=0.1.8, <=0.1.11), sqlfluff-templater-dbt (>=4.0.0a1, <=4.0.4) potentially affected by CVE-2026-46373 via sqlfluff (>=4.0.0a1, <=4.0.4)

sqlfluff PYPI version =4.0.0a1, =0.1.8, =4.0.0a1, =4.0.4 Source cves: CVE-2026-46373 Source advisory: GHSA-WMHF-FQC8-VXHH...

data-designer (>=0.1.0, <=0.2.1), sqlfluff-templater-dataform (0.1.1) +1 more potentially affected by CVE-2026-46373 via sqlfluff (3.2.0)

sqlfluff PYPI version 3.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - data-designer =0.1.0, =0.2.1 - sqlfluff-templater-dataform 0.1.1 - sqlfluff-templater-dbt 3.2.0 Source cves: CVE-2026-46373 Source advisory:...

collate-sqllineage (>=1.6.8, <=1.6.10), sqlfluff-templater-dbt (3.3.1) +2 more potentially affected by CVE-2026-46373 via sqlfluff (3.3.1)

sqlfluff PYPI version 3.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - collate-sqllineage =1.6.8, =1.6.10 - sqlfluff-templater-dbt 3.3.1 - sqllineage 1.5.4 - txt2sql 0.2.0 Source cves: CVE-2026-46373 Source advisory...

dbt-superset-lineage (>=0.1.0, <=0.2.1), dwhgen (>=0.1.1, <=0.1.2) +1 more potentially affected by CVE-2026-46373 via sqlfluff (0.8.2)

sqlfluff PYPI version 0.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - dbt-superset-lineage =0.1.0, =0.1.1, =0.1.5, =0.2.7 Source cves: CVE-2026-46373 Source advisory: OSV:GHSA-WMHF-FQC8-VXHH...

sqlfluff-templater-dbt (2.0.0a4) potentially affected by CVE-2026-46373 via sqlfluff (2.0.0a4)

sqlfluff PYPI version 2.0.0a4 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - sqlfluff-templater-dbt 2.0.0a4 Source cves: CVE-2026-46373 Source advisory: OSV:GHSA-WMHF-FQC8-VXHH...

GHSA-WMHF-FQC8-VXHH SQLFluff: Recursive Stack Overflow in Parser

Impact In deployments where untrusted users can provide SQL queries to be linted, an untrusted user can submit a malicious query with deliberate excessive nesting to any application using the parser to trigger a Denial of Service through resource exhaustion. Patches Versions 4.1.0 and up contain ...

sqlfluff-templater-dbt (3.4.1) potentially affected by CVE-2026-46373 via sqlfluff (3.4.1)

sqlfluff PYPI version 3.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - sqlfluff-templater-dbt 3.4.1 Source cves: CVE-2026-46373 Source advisory: OSV:GHSA-WMHF-FQC8-VXHH...

SQLFluff: Recursive Stack Overflow in Parser

Impact In deployments where untrusted users can provide SQL queries to be linted, an untrusted user can submit a malicious query with deliberate excessive nesting to any application using the parser to trigger a Denial of Service through resource exhaustion. Patches Versions 4.1.0 and up contain ...

dbt-osmosis (>=0.9.3, <=0.10.0), dbt-superset-lineage (>=0.3.0, <=0.3.2) +3 more potentially affected by CVE-2026-46373 via sqlfluff (1.4.5)

sqlfluff PYPI version 1.4.5 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - dbt-osmosis =0.9.3, =0.3.0, =0.8.0, =0.0.0, =0.0.1 - sqlfluff-templater-dbt 1.4.5 Source cves: CVE-2026-46373 Source advisory:...

collate-sqllineage (>=1.2.5, <=1.3.0), custom-connector (>=0.0.1, <=0.0.2) +13 more potentially affected by CVE-2026-46373 via sqlfluff (2.3.5)

sqlfluff PYPI version 2.3.5 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - collate-sqllineage =1.2.5, =0.0.1, =1.3.3, =0.3.1, =0.1.11, =0.1.26, =1.2.3.3, =0.0.1, =1.4.9, =0.1.0, =0.3.0 Source cves: CVE-2026-46373 Source...

EUVD-2023-0242

Malicious code in bioql PyPI...

CVE-2023-36830

SQLFluff is a SQL linter. Prior to version 2.1.2, in environments where untrusted users have access to the config files, there is a potential security vulnerability where those users could use the librarypath config value to allow arbitrary python code to be executed via macros. For many users wh...

Linux Distros Unpatched Vulnerability : CVE-2023-36830

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - SQLFluff is a SQL linter. Prior to version 2.1.2, in environments where untrusted users have access to the config files, there is a potential security...

Arbitrary Code Execution

sqlfluff is vulnerable to Arbitrary Code Execution. The vulnerability exists because the extractlibrariesfromconfig function of jinja.py does not properly enable the CLI option to override the librarypath option in the template, allowing an attacker with access to the config file to inject and...