Lightdash vulnerabilities
We track 4 vulnerabilities in Lightdash products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on October 29, 2026.
Latest Lightdash vulnerabilities
- 8.3 High severity
lightdash: Improper Neutralization of Special Elements used in an SQL Command
Lightdash is an open source business intelligence platform. In affected versions through 0.3213.0, the dbt Cloud webhook `POST /api/v1/projects/{projectUuid}/dbt-cloud/webhook` has no authentication middleware or signature validation. In `packages/backend/src/
- 8.3 High severity
lightdash: Improper Limitation of a Pathname to a Restricted Directory
Lightdash is an open source business intelligence platform. In affected versions through 0.3213.0, the dbt Cloud webhook `POST /api/v1/projects/{projectUuid}/dbt-cloud/webhook` has no authentication middleware or signature validation. In `packages/backend/src/
- 7.3 High severity
Lightdash: Insertion of Sensitive Information Into Sent Data
Lightdash version 0.1024.6 allows users with the necessary permissions, such as Administrator or Editor, to create and share dashboards. A dashboard that contains HTML elements which point to a threat actor controlled source can trigger an SSRF request when ex
- 7.5 High severity
Lightdash: Improper Limitation of a Pathname to a Restricted Directory
packages/backend/src/routers in Lightdash before 0.510.3 has insecure file endpoints, e.g., they allow .. directory traversal and do not ensure that an intended file extension (.csv or .png) is used.