Skip to content
OpenAdvisories

Package · PyPI

dbt-core

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Feed

  • Medium 4.2
    CVE-2024-40637

    Implicit override for built-in materializations from installed packages in dbt-core

    dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. When a user installs a package in dbt, it has the ability to override macros, materializations, and other core componen…

    dbt-labs dbt-core dbt-core PyPI
  • Medium 5.3
    CVE-2024-36105

    dbt allows Binding to an Unrestricted IP Address via socketsocket

    dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. Prior to versions 1.6.15, 1.7.15, and 1.8.1, Binding to `INADDR_ANY (0.0.0.0)` or `IN6ADDR_ANY (::)` exposes an applica…

    dbt-labs dbt-core dbt-core PyPI
  • High 7.5
    GHSA-p72q-h37j-3hq7

    dbt uses a SQLparse version with a high vulnerability

    ### Summary Using a version of `sqlparse` that has a security vulnerability and no way to update in current version of dbt core. Snyk recommends using `sqlparse==0.5` but this causes a conflict with dbt. Snyk states the issues is a recursion error: `SNYK-PYTH…

    dbt-core PyPI
  • Low 3.2
    GHSA-j4g3-3q8x-jxqp

    dbt-core's secret env vars written to package-lock.json in plaintext

    ### Impact When used to pull source code from a private repository using a Personal Access Token (PAT), some versions of dbt-core write a URL with the PAT in plaintext to the `package-lock.yml` file. ### Patches The bug has been fixed in [dbt-core v1.7.3](htt…

    dbt-core PyPI