acdc-aws-etl-pipeline (>=0.1.7, <=0.5.9), balto-core (>=0.1.5, <=0.1.7) +47 more potentially affected by CVE-2026-29790 via dbt-common (>=1.0.0b2, <=1.33.0)

dbt-common PYPI version =1.0.0b2, =0.1.7, =0.1.5, =0.21.7, =0.0.1rc1, =0.1.0a1, =1.0.9, =1.8.0, =1.8.0b2, =1.8.0, =1.8.0rc1, =2.0.0rc1 - dbt-docs-mcp 0.0.1 and more Source cves: CVE-2026-29790 Source advisory: OSV:PYSEC-2026-2440...

dbt-fabric (>=1.8.0rc1, <=1.8.0rc2) potentially affected by CVE-2026-29790 via dbt-common (0.1.6)

dbt-common PYPI version 0.1.6 is affected by a known vulnerability. The following packages have a transitive dependency on dbt-common and may be impacted: - dbt-fabric =1.8.0rc1, =1.8.0rc2 Source cves: CVE-2026-29790 Source advisory: OSV:PYSEC-2026-2440...

PYSEC-2026-2440 dbt-common's commonprefix() doesn't protect against path traversal

Impact What kind of vulnerability is it? Who is impacted? A path traversal vulnerability exists in dbt-common's safeextract function used when extracting tarball archives. The function uses os.path.commonprefix to validate that extracted files remain within the intended destination directory...

Security Bulletin: DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

Summary Open source packages are used as part of the overall processing in DataStage on Cloud Pak for Data. Vulnerability Details CVEID:CVE-2026-29790 DESCRIPTION: dbt-common is the shared common utilities for dbt-core and adapter implementations use. Prior to versions 1.34.2 and 1.37.3, a path...

CVE-2026-29790

dbt-common is the shared common utilities for dbt-core and adapter implementations use. Prior to versions 1.34.2 and 1.37.3, a path traversal vulnerability exists in dbt-common's safeextract function used when extracting tarball archives. The function uses os.path.commonprefix to validate that...

dbt-databricks (>=1.11.1, <=1.11.3) potentially affected by CVE-2026-29790 via dbt-common (1.36.0)

dbt-common PYPI version 1.36.0 is affected by a known vulnerability. The following packages have a transitive dependency on dbt-common and may be impacted: - dbt-databricks =1.11.1, =1.11.3 Source cves: CVE-2026-29790 Source advisory: SNYK:PYTHON-DBTCOMMON-15440507...

acdc-aws-etl-pipeline (>=0.1.7, <=0.5.9), balto-core (>=0.1.5, <=0.1.7) +47 more potentially affected by CVE-2026-29790 via dbt-common (>=1.0.0b2, <=1.33.0)

dbt-common PYPI version =1.0.0b2, =0.1.7, =0.1.5, =0.21.7, =0.0.1rc1, =0.1.0a1, =1.0.9, =1.8.0, =1.8.0b2, =1.8.0, =1.8.0rc1, =2.0.0rc1 - dbt-docs-mcp 0.0.1 and more Source cves: CVE-2026-29790 Source advisory: SNYK:PYTHON-DBTCOMMON-15440507...

Directory Traversal

Overview dbt-common is a The shared common utilities that dbt-core and adapter implementations use Affected versions of this package are vulnerable to Directory Traversal via the safeextract function. An attacker can write files outside the intended extraction directory by supplying a malicious...

CVE-2026-29790

dbt-common is the shared common utilities for dbt-core and adapter implementations use. Prior to versions 1.34.2 and 1.37.3, a path traversal vulnerability exists in dbt-common's safeextract function used when extracting tarball archives. The function uses os.path.commonprefix to validate that...

CVE-2026-29790 dbt-common: commonprefix() doesn't protect against path traversal

dbt-common is the shared common utilities for dbt-core and adapter implementations use. Prior to versions 1.34.2 and 1.37.3, a path traversal vulnerability exists in dbt-common's safeextract function used when extracting tarball archives. The function uses os.path.commonprefix to validate that...

CVE-2026-29790

dbt-common is the shared common utilities for dbt-core and adapter implementations use. Prior to versions 1.34.2 and 1.37.3, a path traversal vulnerability exists in dbt-common's safeextract function used when extracting tarball archives. The function uses os.path.commonprefix to validate that...

CVE-2026-29790 dbt-common: commonprefix() doesn't protect against path traversal

dbt-common is the shared common utilities for dbt-core and adapter implementations use. Prior to versions 1.34.2 and 1.37.3, a path traversal vulnerability exists in dbt-common's safeextract function used when extracting tarball archives. The function uses os.path.commonprefix to validate that...

CVE-2026-29790 dbt-common: commonprefix() doesn't protect against path traversal

dbt-common is the shared common utilities for dbt-core and adapter implementations use. Prior to versions 1.34.2 and 1.37.3, a path traversal vulnerability exists in dbt-common's safeextract function used when extracting tarball archives. The function uses os.path.commonprefix to validate that...

CVE-2026-29790

dbt-common is the shared common utilities for dbt-core and adapter implementations use. Prior to versions 1.34.2 and 1.37.3, a path traversal vulnerability exists in dbt-common's safeextract function used when extracting tarball archives. The function uses os.path.commonprefix to validate that...

dbt-databricks (>=1.11.1, <=1.11.3) potentially affected by CVE-2026-29790 via dbt-common (1.36.0)

dbt-common PYPI version 1.36.0 is affected by a known vulnerability. The following packages have a transitive dependency on dbt-common and may be impacted: - dbt-databricks =1.11.1, =1.11.3 Source cves: CVE-2026-29790 Source advisory: MEND:CVE-2026-29790...

CVE-2026-29790

dbt-common is affected by CVE-2026-29790 due to a path-traversal vulnerability in safe_extract() that uses os.path.commonprefix() for extraction path validation. Because commonprefix() compares paths character-by-character rather than by path components, a malicious tarball could write files outs...

CVE-2026-29790: Improper Limitation of a Pathname to a Restricted Directory

dbt-common is the shared common utilities for dbt-core and adapter implementations use. Prior to versions 1.34.2 and 1.37.3, a path traversal vulnerability exists in dbt-common's safeextract function used when extracting tarball archives. The function uses os.path.commonprefix to validate that...

dbt-fabric (>=1.8.0rc1, <=1.8.0rc2) potentially affected by CVE-2026-29790 via dbt-common (0.1.6)

dbt-common PYPI version 0.1.6 is affected by a known vulnerability. The following packages have a transitive dependency on dbt-common and may be impacted: - dbt-fabric =1.8.0rc1, =1.8.0rc2 Source cves: CVE-2026-29790 Source advisory: OSV:GHSA-W75W-9QV4-J5XJ...

dbt-common's commonprefix() doesn't protect against path traversal

Impact What kind of vulnerability is it? Who is impacted? A path traversal vulnerability exists in dbt-common's safeextract function used when extracting tarball archives. The function uses os.path.commonprefix to validate that extracted files remain within the intended destination directory...

acdc-aws-etl-pipeline (>=0.1.7, <=0.5.9), balto-core (>=0.1.5, <=0.1.7) +47 more potentially affected by CVE-2026-29790 via dbt-common (>=1.0.0b2, <=1.33.0)

dbt-common PYPI version =1.0.0b2, =0.1.7, =0.1.5, =0.21.7, =0.0.1rc1, =0.1.0a1, =1.0.9, =1.8.0, =1.8.0b2, =1.8.0, =1.8.0rc1, =2.0.0rc1 - dbt-docs-mcp 0.0.1 and more Source cves: CVE-2026-29790 Source advisory: OSV:GHSA-W75W-9QV4-J5XJ...