dbt-common's commonprefix() doesn't protect against path traversal

ImpactWhat kind of vulnerability is it? Who is impacted?A path traversal vulnerability exists in dbt-common's safeextract function used when extracting tarball archives. The function uses os.path.commonprefix to validate that extracted files remain within the intended destination directory...