Dataform vulnerabilities

2 known vulnerabilities in Dataform from Google Cloud. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.4 Critical severity

  BigQuery: Missing Authorization

  CVE-2026-14934Jul 13, 2026Google Cloud

  A Missing Authorization vulnerability in the repository creation functionality in Google Cloud BigQuery, Dataform and Colab Enterprise, in the versions between October 2025 and May 10th, 2026, on Google Cloud Platform, allows an authenticated attacker to escal

• 10.0 Critical severity

  Dataform: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2025-9118Aug 25, 2025Google Cloud

  A path traversal vulnerability in the NPM package installation process of Google Cloud Dataform allows a remote attacker to read and write files in other customers' repositories via a maliciously crafted package.json file.