Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
4 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact What kind of vulnerability is it? Who is impacted? When a user installs a package in dbt, it has the ability to override macros, materializations, and other core components of dbt. This is by design, as it allows packages to extend and customize dbt's functionality. However, this also means that a malicious package could potentially override these components with harmful code. Patches Has the problem been patched? What versions should users upgrade to? Fixed on 1.8.0, and patched for 1.6.14 and 1.7.14 releases. Workarounds Is there a way for users to fix or remediate the vulnerability without upgrading? Previously, a materialization defined in a package that shared a name with one of the built-in materializations would be preferred by default, without user action which is surprising and makes it more difficult to detect the insecure behaviour. We've changed the default behaviour to require explicit overrides by users in 1.8.0, and provided the ability to opt-out of built-in…
Recommended action: Upgrade to 1.7.14 or 1.6.14 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Binding to INADDRANY (0.0.0.0) or IN6ADDRANY (::) exposes an application on all network interfaces, increasing the risk of unauthorized access. While doing some static analysis and code inspection, I found the following code binding a socket to INADDRANY by passing "" as the address. This effectively binds to any network interface on the local system, not just localhost (127.0.0.1). Details As stated in the Python docs, a special form for address is accepted instead of a host address: '' represents INADDRANY, equivalent to "0.0.0.0". On systems with IPv6, '' represents IN6ADDRANY, which is equivalent to "::". https://github.com/dbt-labs/dbt-core/blob/main/core/dbt/task/docs/serve.py#L23C38-L23C39 The text around this code also imply the intention is to host docs only on localhost. PoC To recreate, run the docs ServeTask.run() to stand up the HTTP server. Then run netstat to see what addresses this process is bound. Impact A user who serves docs on an unsecured public network,…
Recommended action: Upgrade to 1.8.1, 1.7.15 or 1.6.15 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Using a version of sqlparse that has a security vulnerability and no way to update in current version of dbt core. Snyk recommends using sqlparse==0.5 but this causes a conflict with dbt. Snyk states the issues is a recursion error: SNYK-PYTHON-SQLPARSE-6615674. Details Dependency conflict error message: Resolution was to pin sqlparse =0.5.0, <0.6.0 in dbt-core, patched in 1.6.13 and 1.7.13. PoC From Snyk: Impact Snyk classifies it as high 7.5/10. Patches The bug has been fixed in dbt-core v1.6.13 and dbt-core v1.7.13. Mitigations Bump dbt-core 1.6 and 1.7 dependencies to 1.6.13 and 1.7.13 respectively
Recommended action: Upgrade to 1.7.13 or 1.6.13 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact When used to pull source code from a private repository using a Personal Access Token (PAT), some versions of dbt-core write a URL with the PAT in plaintext to the package-lock.yml file. Patches The bug has been fixed in dbt-core v1.7.3. Mitigations Remove any git URLs with plaintext secrets from package-lock.yml file(s) on servers, workstations, or in source control. Rotate any tokens that have been written to version-controlled files.
Recommended action: Upgrade to 1.7.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.