PT-2026-102889

Name of the Vulnerable Software and Affected Versions dbt versions 2.0.0-alpha.0 through 2.0.0-alpha.4 Description dbt docs serve exposes an unauthenticated POST '/api/v1/query' endpoint. This endpoint passes caller-supplied SQL to the DuckDbViewsBackend::query arrow function without authorizatio...

GHSA-CFQR-CJX5-5JCM vulnerabilities

Vulnerabilities for packages: dbt-bigquery, mlflow, dbt-core...

CVE-2026-84305 vulnerabilities

Vulnerabilities for packages: dbt-bigquery, mlflow, dbt-core...

dbt-common's commonprefix() doesn't protect against path traversal

ImpactWhat kind of vulnerability is it? Who is impacted?A path traversal vulnerability exists in dbt-common's safeextract function used when extracting tarball archives. The function uses os.path.commonprefix to validate that extracted files remain within the intended destination directory...

dbt (0.16.0), dbt-bigquery (0.16.0) +7 more potentially affected by CVE-2024-36105 via dbt-core (0.16.0)

dbt-core PYPI version 0.16.0 is affected by a known vulnerability. The following packages have a transitive dependency on dbt-core and may be impacted: - dbt 0.16.0 - dbt-bigquery 0.16.0 - dbt-oracle =0.1.3, =0.1.0, =0.2.0 - dbt-snowflake 0.16.0 - dbt-spark 0.16.0 Source cves: CVE-2024-36105 Sour...

dbt (0.20.0b1), dbt-bigquery (0.20.0b1) +3 more potentially affected by CVE-2024-36105 via dbt-core (0.20.0b1)

dbt-core PYPI version 0.20.0b1 is affected by a known vulnerability. The following packages have a transitive dependency on dbt-core and may be impacted: - dbt 0.20.0b1 - dbt-bigquery 0.20.0b1 - dbt-postgres 0.20.0b1 - dbt-redshift 0.20.0b1 - dbt-snowflake 0.20.0b1 Source cves: CVE-2024-36105...

dbt (0.20.0), dbt-bigquery (0.20.0) +11 more potentially affected by CVE-2024-36105 via dbt-core (0.20.0)

dbt-core PYPI version 0.20.0 is affected by a known vulnerability. The following packages have a transitive dependency on dbt-core and may be impacted: - dbt 0.20.0 - dbt-bigquery 0.20.0 - dbt-clickhouse 0.20.0 - dbt-cratedb 0.21.0.0 - dbt-materialize 0.20.0 - dbt-mysql 0.20.0 - dbt-postgres 0.20...

dbt (0.21.0b2), dbt-bigquery (0.21.0b2) +5 more potentially affected by CVE-2024-36105 via dbt-core (0.21.0b2)

dbt-core PYPI version 0.21.0b2 is affected by a known vulnerability. The following packages have a transitive dependency on dbt-core and may be impacted: - dbt 0.21.0b2 - dbt-bigquery 0.21.0b2 - dbt-postgres 0.21.0b2 - dbt-presto 0.21.0b2 - dbt-redshift 0.21.0b2 - dbt-snowflake 0.21.0b2 - dbt-spa...

dbt (0.19.0), dbt-bigquery (0.19.0) +10 more potentially affected by CVE-2024-36105 via dbt-core (0.19.0)

dbt-core PYPI version 0.19.0 is affected by a known vulnerability. The following packages have a transitive dependency on dbt-core and may be impacted: - dbt 0.19.0 - dbt-bigquery 0.19.0 - dbt-clickhouse =0.19.0.1, =0.19.0.0, =0.19.0, =0.3.1, =0.19.0, =0.19.0a0, =0.19.0.6 Source cves:...

dbt (0.19.1rc2), dbt-bigquery (0.19.1rc2) +2 more potentially affected by CVE-2024-36105 via dbt-core (0.19.1rc2)

dbt-core PYPI version 0.19.1rc2 is affected by a known vulnerability. The following packages have a transitive dependency on dbt-core and may be impacted: - dbt 0.19.1rc2 - dbt-bigquery 0.19.1rc2 - dbt-postgres 0.19.1rc2 - dbt-redshift 0.19.1rc2 Source cves: CVE-2024-36105 Source advisory:...

dbt (0.19.2rc1), dbt-bigquery (0.19.2rc1) +2 more potentially affected by CVE-2024-36105 via dbt-core (0.19.2rc1)

dbt-core PYPI version 0.19.2rc1 is affected by a known vulnerability. The following packages have a transitive dependency on dbt-core and may be impacted: - dbt 0.19.2rc1 - dbt-bigquery 0.19.2rc1 - dbt-postgres 0.19.2rc1 - dbt-redshift 0.19.2rc1 Source cves: CVE-2024-36105 Source advisory:...

dbt (0.19.0b1), dbt-bigquery (0.19.0b1) +2 more potentially affected by CVE-2024-36105 via dbt-core (0.19.0b1)

dbt-core PYPI version 0.19.0b1 is affected by a known vulnerability. The following packages have a transitive dependency on dbt-core and may be impacted: - dbt 0.19.0b1 - dbt-bigquery 0.19.0b1 - dbt-postgres 0.19.0b1 - dbt-redshift 0.19.0b1 Source cves: CVE-2024-36105 Source advisory:...

dbt (0.19.0rc3), dbt-bigquery (0.19.0rc3) +2 more potentially affected by CVE-2024-36105 via dbt-core (0.19.0rc3)

dbt-core PYPI version 0.19.0rc3 is affected by a known vulnerability. The following packages have a transitive dependency on dbt-core and may be impacted: - dbt 0.19.0rc3 - dbt-bigquery 0.19.0rc3 - dbt-postgres 0.19.0rc3 - dbt-redshift 0.19.0rc3 Source cves: CVE-2024-36105 Source advisory:...

dbt (0.15.3rc1), dbt-bigquery (0.15.3rc1) +3 more potentially affected by CVE-2024-36105 via dbt-core (0.15.3rc1)

dbt-core PYPI version 0.15.3rc1 is affected by a known vulnerability. The following packages have a transitive dependency on dbt-core and may be impacted: - dbt 0.15.3rc1 - dbt-bigquery 0.15.3rc1 - dbt-postgres 0.15.3rc1 - dbt-redshift 0.15.3rc1 - dbt-snowflake 0.15.3rc1 Source cves: CVE-2024-361...

dbt (0.16.0rc1), dbt-bigquery (0.16.0rc1) +3 more potentially affected by CVE-2024-36105 via dbt-core (0.16.0rc1)

dbt-core PYPI version 0.16.0rc1 is affected by a known vulnerability. The following packages have a transitive dependency on dbt-core and may be impacted: - dbt 0.16.0rc1 - dbt-bigquery 0.16.0rc1 - dbt-postgres 0.16.0rc1 - dbt-redshift 0.16.0rc1 - dbt-snowflake 0.16.0rc1 Source cves: CVE-2024-361...

dbt (0.16.0rc3), dbt-bigquery (0.16.0rc3) +3 more potentially affected by CVE-2024-36105 via dbt-core (0.16.0rc3)

dbt-core PYPI version 0.16.0rc3 is affected by a known vulnerability. The following packages have a transitive dependency on dbt-core and may be impacted: - dbt 0.16.0rc3 - dbt-bigquery 0.16.0rc3 - dbt-postgres 0.16.0rc3 - dbt-redshift 0.16.0rc3 - dbt-snowflake 0.16.0rc3 Source cves: CVE-2024-361...

dbt (0.16.1), dbt-bigquery (0.16.1) +6 more potentially affected by CVE-2024-36105 via dbt-core (0.16.1)

dbt-core PYPI version 0.16.1 is affected by a known vulnerability. The following packages have a transitive dependency on dbt-core and may be impacted: - dbt 0.16.1 - dbt-bigquery 0.16.1 - dbt-postgres 0.16.1 - dbt-presto 0.16.1 - dbt-redshift 0.16.1 - dbt-snowflake 0.16.1 - dbt-spark 0.16.1 - dd...

dbt (0.15.3), dbt-bigquery (0.15.3) +5 more potentially affected by CVE-2024-36105 via dbt-core (0.15.3)

dbt-core PYPI version 0.15.3 is affected by a known vulnerability. The following packages have a transitive dependency on dbt-core and may be impacted: - dbt 0.15.3 - dbt-bigquery 0.15.3 - dbt-postgres 0.15.3 - dbt-presto 0.15.3 - dbt-redshift 0.15.3 - dbt-snowflake 0.15.3 - dbt-sqlserver 0.15.3....

dbt (0.17.0b1), dbt-bigquery (0.17.0b1) +3 more potentially affected by CVE-2024-36105 via dbt-core (0.17.0b1)

dbt-core PYPI version 0.17.0b1 is affected by a known vulnerability. The following packages have a transitive dependency on dbt-core and may be impacted: - dbt 0.17.0b1 - dbt-bigquery 0.17.0b1 - dbt-postgres 0.17.0b1 - dbt-redshift 0.17.0b1 - dbt-snowflake 0.17.0b1 Source cves: CVE-2024-36105...

dbt (0.17.1rc1), dbt-bigquery (0.17.1rc1) +3 more potentially affected by CVE-2024-36105 via dbt-core (0.17.1rc1)

dbt-core PYPI version 0.17.1rc1 is affected by a known vulnerability. The following packages have a transitive dependency on dbt-core and may be impacted: - dbt 0.17.1rc1 - dbt-bigquery 0.17.1rc1 - dbt-postgres 0.17.1rc1 - dbt-redshift 0.17.1rc1 - dbt-snowflake 0.17.1rc1 Source cves: CVE-2024-361...