gha-lab-4a8fad8536

Automated research artifact — not the upstream project. This repository is a disposable lab built by an automated harness for a master's thesis at Université Laval on reproducing published GitHub Actions workflow vulnerabilities. It is a verbatim snapshot of dbt-labs/actions at commit...

Malicious code in dbt-adapter (PyPI)

Source: kam193 baabd8e63cd4f6ad9e5a4ff9c2575b965d85030868aa31cc485902475b26465e Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but al...

Malicious code in dbt-adapter (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d382d03c04666ce376e75c85a7c1af5ec63c2f203aa1f4787b713c56cbcee831 setup.py in the sdist defines a custom install cmdclass InstallWithBeacon that executes during pip install. It calls socket.gethostname and...

MAL-2026-18704 Malicious code in dbt-adapter (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d382d03c04666ce376e75c85a7c1af5ec63c2f203aa1f4787b713c56cbcee831 setup.py in the sdist defines a custom install cmdclass InstallWithBeacon that executes during pip install. It calls socket.gethostname and...

CVE-2026-61654

Lightdash is an open source business intelligence platform. In affected versions through 0.3213.0, the dbt Cloud webhook POST /api/v1/projects/projectUuid/dbt-cloud/webhook has no authentication middleware or signature validation. In packages/backend/src/controllers/projectController.ts,...

CVE-2026-61654 Lightdash: Unauthenticated dbt Cloud webhook with path injection leaks API key

Lightdash is an open source business intelligence platform. In affected versions through 0.3213.0, the dbt Cloud webhook POST /api/v1/projects/projectUuid/dbt-cloud/webhook has no authentication middleware or signature validation. In packages/backend/src/controllers/projectController.ts,...

CVE-2026-61654 Lightdash: Unauthenticated dbt Cloud webhook with path injection leaks API key

Lightdash is an open source business intelligence platform. In affected versions through 0.3213.0, the dbt Cloud webhook POST /api/v1/projects/projectUuid/dbt-cloud/webhook has no authentication middleware or signature validation. In packages/backend/src/controllers/projectController.ts,...

EUVD-2026-113396

Lightdash is an open source business intelligence platform. In affected versions through 0.3213.0, the dbt Cloud webhook POST /api/v1/projects/projectUuid/dbt-cloud/webhook has no authentication middleware or signature validation. In packages/backend/src/controllers/projectController.ts,...

CVE-2026-61654

The business intelligence platform Lightdash (versions through 0.3213.0) contains a vulnerability in the dbt Cloud webhook endpoint (POST /api/v1/projects/{projectUuid}/dbt-cloud/webhook). The issue stems from a lack of authentication middleware or signature validation, combined with path injecti...

CVE-2026-61654

Lightdash is an open source business intelligence platform. In affected versions through 0.3213.0, the dbt Cloud webhook "POST /api/v1/projects/projectUuid/dbt-cloud/webhook" has no authentication middleware or signature validation. In "packages/backend/src/controllers/projectController.ts",...

CVE-2026-61576

Lightdash is an open source business intelligence platform. In affected versions through 0.3213.0, the dbt Cloud webhook POST /api/v1/projects/projectUuid/dbt-cloud/webhook has no authentication middleware or signature validation. In packages/backend/src/controllers/projectController.ts,...

EUVD-2026-113389

Lightdash is an open source business intelligence platform. In affected versions through 0.3213.0, the dbt Cloud webhook POST /api/v1/projects/projectUuid/dbt-cloud/webhook has no authentication middleware or signature validation. In packages/backend/src/controllers/projectController.ts,...

CVE-2026-61576

The open-source business intelligence platform Lightdash (versions through 0.3213.0) contains an unauthenticated dbt Cloud webhook at POST /api/v1/projects/{projectUuid}/dbt-cloud/webhook lacking authentication middleware or signature validation. The vulnerability resides in packages/backend/src/...

CVE-2026-61576 Lightdash: Unauthenticated dbt Cloud webhook with path injection leaks API key

Lightdash is an open source business intelligence platform. In affected versions through 0.3213.0, the dbt Cloud webhook POST /api/v1/projects/projectUuid/dbt-cloud/webhook has no authentication middleware or signature validation. In packages/backend/src/controllers/projectController.ts,...

CVE-2026-61576 Lightdash: Unauthenticated dbt Cloud webhook with path injection leaks API key

Lightdash is an open source business intelligence platform. In affected versions through 0.3213.0, the dbt Cloud webhook POST /api/v1/projects/projectUuid/dbt-cloud/webhook has no authentication middleware or signature validation. In packages/backend/src/controllers/projectController.ts,...

CVE-2026-61576 Lightdash: Unauthenticated dbt Cloud webhook with path injection leaks API key

Lightdash is an open source business intelligence platform. In affected versions through 0.3213.0, the dbt Cloud webhook POST /api/v1/projects/projectUuid/dbt-cloud/webhook has no authentication middleware or signature validation. In packages/backend/src/controllers/projectController.ts,...

CVE-2026-61576

Lightdash is an open source business intelligence platform. In affected versions through 0.3213.0, the dbt Cloud webhook "POST /api/v1/projects/projectUuid/dbt-cloud/webhook" has no authentication middleware or signature validation. In "packages/backend/src/controllers/projectController.ts",...

CVE-2026-61576: lightdash: Lightdash is an open source business intelligence platform

Lightdash is an open source business intelligence platform. In affected versions through 0.3213.0, the dbt Cloud webhook POST /api/v1/projects/projectUuid/dbt-cloud/webhook has no authentication middleware or signature validation. In packages/backend/src/controllers/projectController.ts,...

CVE-2026-61654: lightdash: Lightdash is an open source business intelligence platform

Lightdash is an open source business intelligence platform. In affected versions through 0.3213.0, the dbt Cloud webhook POST /api/v1/projects/projectUuid/dbt-cloud/webhook has no authentication middleware or signature validation. In packages/backend/src/controllers/projectController.ts,...

PT-2026-132846

Lightdash is an open source business intelligence platform. In affected versions through 0.3213.0, the dbt Cloud webhook POST /api/v1/projects/projectUuid/dbt-cloud/webhook has no authentication middleware or signature validation. In packages/backend/src/controllers/projectController.ts,...