Skip to content
OpenAdvisories

Package · PyPI

dbt-core

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Low 3.2
    GHSA-j4g3-3q8x-jxqp

    dbt-core's secret env vars written to package-lock.json in plaintext

    ### Impact When used to pull source code from a private repository using a Personal Access Token (PAT), some versions of dbt-core write a URL with the PAT in plaintext to the `package-lock.yml` file. ### Patches The bug has been fixed in [dbt-core v1.7.3](htt…

    dbt-core PyPI