Dbt-labs vulnerabilities
We track 3 vulnerabilities in Dbt-labs products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on October 14, 2026.
Latest Dbt-labs vulnerabilities
- 8.2 High severity
dbt-core: Improper Limitation of a Pathname to a Restricted Directory
dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. From 2.0.0-alpha.0 until 2.0.0-alpha.5, dbt docs serve exposes the unauthenticated POST /api/v1/query endpoint in crates
- 9.3 Critical severity
dbt-core: Improper Neutralization of Special Elements used in an OS Command
dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. Inside the reusable workflow dbt-labs/actions/blob/main/.github/workflows/open-issue-in-repo.yml, the prep job uses pete
- 7.3 High severity
dbt-core: Improper Control of Generation of Code
dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. When a user installs a package in dbt, it has the ability to override macros, materializations, and other core component