SQLFluff users with access to config file, using `libary_path` may call arbitrary python code

Impact In environments where untrusted users have access to the config files e.g. .sqlfluff, there is a potential security vulnerability where those users could use the librarypath config value to allow arbitrary python code to be executed via macros. Jinja macros are executed within a sandboxed...

dbt-superset-lineage (>=0.1.0, <=0.2.1), dwhgen (>=0.1.1, <=0.1.2) +1 more potentially affected by CVE-2023-36830 via sqlfluff (0.8.2)

sqlfluff PYPI version 0.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - dbt-superset-lineage =0.1.0, =0.1.1, =0.1.5, =0.2.7 Source cves: CVE-2023-36830 Source advisory: OSV:GHSA-JQHC-M2J3-FJRX...

CVE-2023-36830

SQLFluff is a SQL linter. Prior to version 2.1.2, in environments where untrusted users have access to the config files, there is a potential security vulnerability where those users could use the librarypath config value to allow arbitrary python code to be executed via macros. For many users wh...

DEBIAN-CVE-2023-36830

SQLFluff is a SQL linter. Prior to version 2.1.2, in environments where untrusted users have access to the config files, there is a potential security vulnerability where those users could use the librarypath config value to allow arbitrary python code to be executed via macros. For many users wh...

Design/Logic Flaw

SQLFluff is a SQL linter. Prior to version 2.1.2, in environments where untrusted users have access to the config files, there is a potential security vulnerability where those users could use the librarypath config value to allow arbitrary python code to be executed via macros. For many users wh...

sqlfluff-templater-dbt (1.3.0) potentially affected by CVE-2023-36830 via sqlfluff (1.3.0)

sqlfluff PYPI version 1.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - sqlfluff-templater-dbt 1.3.0 Source cves: CVE-2023-36830 Source advisory: OSV:PYSEC-2023-111...

sqlfluff-templater-dbt (1.3.1) potentially affected by CVE-2023-36830 via sqlfluff (1.3.1)

sqlfluff PYPI version 1.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - sqlfluff-templater-dbt 1.3.1 Source cves: CVE-2023-36830 Source advisory: OSV:PYSEC-2023-111...

sqlfluff-templater-dbt (1.4.0) potentially affected by CVE-2023-36830 via sqlfluff (1.4.0)

sqlfluff PYPI version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - sqlfluff-templater-dbt 1.4.0 Source cves: CVE-2023-36830 Source advisory: OSV:PYSEC-2023-111...

sqlfluff-templater-dbt (1.4.1) potentially affected by CVE-2023-36830 via sqlfluff (1.4.1)

sqlfluff PYPI version 1.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - sqlfluff-templater-dbt 1.4.1 Source cves: CVE-2023-36830 Source advisory: OSV:PYSEC-2023-111...

sqlfluff-templater-dbt (1.4.2) potentially affected by CVE-2023-36830 via sqlfluff (1.4.2)

sqlfluff PYPI version 1.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - sqlfluff-templater-dbt 1.4.2 Source cves: CVE-2023-36830 Source advisory: OSV:PYSEC-2023-111...

dbt-coves (>=0.21.0a2, <=0.21.0a16), dwhgen (0.1.0) +1 more potentially affected by CVE-2023-36830 via sqlfluff (0.7.1)

sqlfluff PYPI version 0.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - dbt-coves =0.21.0a2, =0.1.0, =0.14.0 Source cves: CVE-2023-36830 Source advisory: OSV:PYSEC-2023-111...

dbt-superset-lineage (>=0.1.0, <=0.2.1), dwhgen (>=0.1.1, <=0.1.2) +1 more potentially affected by CVE-2023-36830 via sqlfluff (0.8.2)

sqlfluff PYPI version 0.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - dbt-superset-lineage =0.1.0, =0.1.1, =0.1.5, =0.2.7 Source cves: CVE-2023-36830 Source advisory: OSV:PYSEC-2023-111...

alvin-cli (>=0.2.0, <=1.2.0rc14) potentially affected by CVE-2023-36830 via sqlfluff (0.13.0)

sqlfluff PYPI version 0.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - alvin-cli =0.2.0, =1.2.0rc14 Source cves: CVE-2023-36830 Source advisory: OSV:PYSEC-2023-111...

sqlfluff-templater-dbt (1.2.1) potentially affected by CVE-2023-36830 via sqlfluff (1.2.1)

sqlfluff PYPI version 1.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - sqlfluff-templater-dbt 1.2.1 Source cves: CVE-2023-36830 Source advisory: OSV:PYSEC-2023-111...

sqlfluff-templater-dbt (1.3.2) potentially affected by CVE-2023-36830 via sqlfluff (1.3.2)

sqlfluff PYPI version 1.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - sqlfluff-templater-dbt 1.3.2 Source cves: CVE-2023-36830 Source advisory: OSV:PYSEC-2023-111...

sqlfluff-templater-dbt (1.4.3) potentially affected by CVE-2023-36830 via sqlfluff (1.4.3)

sqlfluff PYPI version 1.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - sqlfluff-templater-dbt 1.4.3 Source cves: CVE-2023-36830 Source advisory: OSV:PYSEC-2023-111...

sqlfluff-templater-dbt (1.4.4) potentially affected by CVE-2023-36830 via sqlfluff (1.4.4)

sqlfluff PYPI version 1.4.4 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - sqlfluff-templater-dbt 1.4.4 Source cves: CVE-2023-36830 Source advisory: OSV:PYSEC-2023-111...

dbt-osmosis (>=0.9.3, <=0.10.0), dbt-superset-lineage (>=0.3.0, <=0.3.2) +3 more potentially affected by CVE-2023-36830 via sqlfluff (1.4.5)

sqlfluff PYPI version 1.4.5 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - dbt-osmosis =0.9.3, =0.3.0, =0.8.0, =0.0.0, =0.0.1 - sqlfluff-templater-dbt 1.4.5 Source cves: CVE-2023-36830 Source advisory: OSV:PYSEC-2023-11...

alvin-cli (>=1.1.9, <=1.2.0), cumulus-library (>=0.1.2, <=1.4.0) +6 more potentially affected by CVE-2023-36830 via sqlfluff (>=2.0.0a1, <=2.1.1)

sqlfluff PYPI version =2.0.0a1, =1.1.9, =0.1.2, =0.1.2, =0.13.2.6, =1.0.2, =2.0.0a1, =1.4.2, =0.1.0, =0.1.1 Source cves: CVE-2023-36830 Source advisory: OSV:PYSEC-2023-111...

dbt-coves (>=0.19.1a7, <=0.21.0a1), jsqlib (>=0.3.0a0, <=0.8.0a0) potentially affected by CVE-2023-36830 via sqlfluff (0.6.9)

sqlfluff PYPI version 0.6.9 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - dbt-coves =0.19.1a7, =0.3.0a0, =0.8.0a0 Source cves: CVE-2023-36830 Source advisory: OSV:PYSEC-2023-111...