Vulnerability-Lookup

PYSEC-2026-2440

Vulnerability from pysec - Published: 2026-07-13 14:36 - Updated: 2026-07-13 16:03

Details

Impact

What kind of vulnerability is it? Who is impacted?

A path traversal vulnerability exists in dbt-common's safe_extract() function used when extracting tarball archives. The function uses os.path.commonprefix() to validate that extracted files remain within the intended destination directory. However, commonprefix() compares paths character-by-character rather than by path components, allowing a malicious tarball to write files to sibling directories with matching name prefixes.

For example, when extracting to /tmp/packages, a crafted tarball could write files to /tmp/packagesevil/ by exploiting the character-based prefix matching.

This vulnerability affects users who: - Install dbt packages from untrusted sources - Process tarball archives through dbt-common's extraction utilities

The practical risk is limited because: - Exploitation requires a malicious tarball to be processed - File writes are restricted to sibling directories with matching prefixes (not arbitrary paths) - Packages from trusted sources (dbt Hub) are not affected

This is similar to CVE-2026-1703 in pip, which had a CVSS score of 3.9 (Low).

Patches

Has the problem been patched? What versions should users upgrade to?

Fixed in dbt-common version 1.37.3 & 1.34.2, and patched for dbt-core 1.11.7 and 1.10.20 releases.

The fix replaces os.path.commonprefix() with os.path.commonpath(), which correctly compares paths by their components rather than characters.

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

Only install dbt packages from trusted sources (official dbt Hub, verified git repositories)
Avoid installing packages from untrusted URLs or unverified third parties
Review package contents before installation when sourcing from external locations

Resources

Are there any links users can visit to find out more?

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): https://cwe.mitre.org/data/definitions/22.html
CVE-2026-1703 (similar vulnerability in pip): https://nvd.nist.gov/vuln/detail/CVE-2026-1703
pip fix PR #13777: https://github.com/pypa/pip/pull/13777
Python documentation on commonpath vs commonprefix: https://docs.python.org/3/library/os.path.html#os.path.commonpath

Severity

2.0 (Low)


                  
                    CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Impacted products

Name	purl
dbt-common	pkg:pypi/dbt-common

Aliases

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "dbt-common",
        "purl": "pkg:pypi/dbt-common"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.34.2"
            },
            {
              "introduced": "1.35.0"
            },
            {
              "fixed": "1.37.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.1.0",
        "0.1.0a1",
        "0.1.1",
        "0.1.3",
        "0.1.4",
        "0.1.5",
        "0.1.6",
        "1.0.0",
        "1.0.0b1",
        "1.0.0b2",
        "1.0.1",
        "1.0.2",
        "1.0.3",
        "1.0.4",
        "1.1.0",
        "1.10.0",
        "1.11.0",
        "1.12.0",
        "1.13.0",
        "1.14.0",
        "1.15.0",
        "1.16.0",
        "1.17.0",
        "1.18",
        "1.19",
        "1.2.0",
        "1.20",
        "1.21.0",
        "1.22.0",
        "1.23.0",
        "1.24.0",
        "1.25.0",
        "1.25.1",
        "1.26.0",
        "1.27.0",
        "1.27.1",
        "1.28.0",
        "1.29.0",
        "1.3.0",
        "1.30.0",
        "1.31.0",
        "1.32.0",
        "1.33.0",
        "1.34.0",
        "1.34.1",
        "1.35.0",
        "1.36.0",
        "1.37.0",
        "1.37.1",
        "1.37.2",
        "1.4.0",
        "1.5.0",
        "1.6.0",
        "1.7.0",
        "1.8.0",
        "1.9.0"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-29790",
    "GHSA-w75w-9qv4-j5xj"
  ],
  "details": "### Impact\n_What kind of vulnerability is it? Who is impacted?_\n\nA path traversal vulnerability exists in dbt-common\u0027s `safe_extract()` function used when extracting tarball archives. The function uses `os.path.commonprefix()` to validate that extracted files remain within the intended destination directory. However, `commonprefix()` compares paths character-by-character rather than by path components, allowing a malicious tarball to write files to sibling directories with matching name prefixes.\n\nFor example, when extracting to `/tmp/packages`, a crafted tarball could write files to `/tmp/packagesevil/` by exploiting the character-based prefix matching.\n\nThis vulnerability affects users who:\n- Install dbt packages from untrusted sources\n- Process tarball archives through dbt-common\u0027s extraction utilities\n\nThe practical risk is limited because:\n- Exploitation requires a malicious tarball to be processed\n- File writes are restricted to sibling directories with matching prefixes (not arbitrary paths)\n- Packages from trusted sources (dbt Hub) are not affected\n\nThis is similar to CVE-2026-1703 in pip, which had a CVSS score of 3.9 (Low).\n\n### Patches\n_Has the problem been patched? What versions should users upgrade to?_\n\nFixed in `dbt-common` version 1.37.3 \u0026 1.34.2, and patched for dbt-core 1.11.7 and 1.10.20 releases.\n\nThe fix replaces `os.path.commonprefix()` with `os.path.commonpath()`, which correctly compares paths by their components rather than characters.\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\n\n- Only install dbt packages from trusted sources (official dbt Hub, verified git repositories)\n- Avoid installing packages from untrusted URLs or unverified third parties\n- Review package contents before installation when sourcing from external locations\n\n### Resources\n_Are there any links users can visit to find out more?_\n\n1. CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027): https://cwe.mitre.org/data/definitions/22.html\n2. CVE-2026-1703 (similar vulnerability in pip): https://nvd.nist.gov/vuln/detail/CVE-2026-1703\n3. pip fix PR #13777: https://github.com/pypa/pip/pull/13777\n4. Python documentation on `commonpath` vs `commonprefix`: https://docs.python.org/3/library/os.path.html#os.path.commonpath",
  "id": "PYSEC-2026-2440",
  "modified": "2026-07-13T16:03:50.863034Z",
  "published": "2026-07-13T14:36:40.777932Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/dbt-labs/dbt-common/security/advisories/GHSA-w75w-9qv4-j5xj"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-29790"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/pip/pull/13777"
    },
    {
      "type": "WEB",
      "url": "https://github.com/dbt-labs/dbt-common/commit/e547954a48bac9394ef6eb98432e429dce9a7709"
    },
    {
      "type": "WEB",
      "url": "https://docs.python.org/3/library/os.path.html#os.path.commonpath"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-6vgw-5pg2-w6jp"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/dbt-labs/dbt-common"
    },
    {
      "type": "PACKAGE",
      "url": "https://pypi.org/project/dbt-common"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-w75w-9qv4-j5xj"
    }
  ],
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "dbt-common\u0027s commonprefix() doesn\u0027t protect against path traversal"
}

CVE-2026-29790 (GCVE-0-2026-29790)

Vulnerability from cvelistv5 – Published: 2026-03-06 20:37 – Updated: 2026-03-09 20:54

Title

dbt-common: commonprefix() doesn't protect against path traversal

Summary

dbt-common is the shared common utilities for dbt-core and adapter implementations use. Prior to versions 1.34.2 and 1.37.3, a path traversal vulnerability exists in dbt-common's safe_extract() function used when extracting tarball archives. The function uses os.path.commonprefix() to validate that extracted files remain within the intended destination directory. However, commonprefix() compares paths character-by-character rather than by path components, allowing a malicious tarball to write files to sibling directories with matching name prefixes. This issue has been patched in versions 1.34.2 and 1.37.3.

Severity

2 (Low)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

GitHub_M

References

3 references

URL	Tags
https://github.com/dbt-labs/dbt-common/security/a…	x_refsource_CONFIRM
https://github.com/pypa/pip/pull/13777	x_refsource_MISC
https://github.com/dbt-labs/dbt-common/commit/e54…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
dbt-labs	dbt-common	Affected: < 1.37.3 Affected: < 1.34.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-29790",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-09T20:50:37.998764Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-09T20:54:30.453Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "dbt-common",
          "vendor": "dbt-labs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.37.3"
            },
            {
              "status": "affected",
              "version": "\u003c 1.34.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "dbt-common is the shared common utilities for dbt-core and adapter implementations use. Prior to versions 1.34.2 and 1.37.3, a path traversal vulnerability exists in dbt-common\u0027s safe_extract() function used when extracting tarball archives. The function uses os.path.commonprefix() to validate that extracted files remain within the intended destination directory. However, commonprefix() compares paths character-by-character rather than by path components, allowing a malicious tarball to write files to sibling directories with matching name prefixes. This issue has been patched in versions 1.34.2 and 1.37.3."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2,
            "baseSeverity": "LOW",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-06T20:37:42.354Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/dbt-labs/dbt-common/security/advisories/GHSA-w75w-9qv4-j5xj",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/dbt-labs/dbt-common/security/advisories/GHSA-w75w-9qv4-j5xj"
        },
        {
          "name": "https://github.com/pypa/pip/pull/13777",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pypa/pip/pull/13777"
        },
        {
          "name": "https://github.com/dbt-labs/dbt-common/commit/e547954a48bac9394ef6eb98432e429dce9a7709",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/dbt-labs/dbt-common/commit/e547954a48bac9394ef6eb98432e429dce9a7709"
        }
      ],
      "source": {
        "advisory": "GHSA-w75w-9qv4-j5xj",
        "discovery": "UNKNOWN"
      },
      "title": "dbt-common: commonprefix() doesn\u0027t protect against path traversal"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-29790",
    "datePublished": "2026-03-06T20:37:42.354Z",
    "dateReserved": "2026-03-04T16:26:02.900Z",
    "dateUpdated": "2026-03-09T20:54:30.453Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

GHSA-W75W-9QV4-J5XJ

Vulnerability from github – Published: 2026-03-05 00:59 – Updated: 2026-03-06 22:51

Summary

dbt-common's commonprefix() doesn't protect against path traversal

Details

Impact

What kind of vulnerability is it? Who is impacted?

For example, when extracting to /tmp/packages, a crafted tarball could write files to /tmp/packagesevil/ by exploiting the character-based prefix matching.

This vulnerability affects users who: - Install dbt packages from untrusted sources - Process tarball archives through dbt-common's extraction utilities

This is similar to CVE-2026-1703 in pip, which had a CVSS score of 3.9 (Low).

Patches

Has the problem been patched? What versions should users upgrade to?

Fixed in dbt-common version 1.37.3 & 1.34.2, and patched for dbt-core 1.11.7 and 1.10.20 releases.

The fix replaces os.path.commonprefix() with os.path.commonpath(), which correctly compares paths by their components rather than characters.

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

Only install dbt packages from trusted sources (official dbt Hub, verified git repositories)
Avoid installing packages from untrusted URLs or unverified third parties
Review package contents before installation when sourcing from external locations

Resources

Are there any links users can visit to find out more?

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): https://cwe.mitre.org/data/definitions/22.html
CVE-2026-1703 (similar vulnerability in pip): https://nvd.nist.gov/vuln/detail/CVE-2026-1703
pip fix PR #13777: https://github.com/pypa/pip/pull/13777
Python documentation on commonpath vs commonprefix: https://docs.python.org/3/library/os.path.html#os.path.commonpath

Severity

2.0 (Low)


                  
                    CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "dbt-common"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.34.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "dbt-common"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.35.0"
            },
            {
              "fixed": "1.37.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-29790"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-05T00:59:10Z",
    "nvd_published_at": "2026-03-06T21:16:15Z",
    "severity": "LOW"
  },
  "details": "### Impact\n_What kind of vulnerability is it? Who is impacted?_\n\nA path traversal vulnerability exists in dbt-common\u0027s `safe_extract()` function used when extracting tarball archives. The function uses `os.path.commonprefix()` to validate that extracted files remain within the intended destination directory. However, `commonprefix()` compares paths character-by-character rather than by path components, allowing a malicious tarball to write files to sibling directories with matching name prefixes.\n\nFor example, when extracting to `/tmp/packages`, a crafted tarball could write files to `/tmp/packagesevil/` by exploiting the character-based prefix matching.\n\nThis vulnerability affects users who:\n- Install dbt packages from untrusted sources\n- Process tarball archives through dbt-common\u0027s extraction utilities\n\nThe practical risk is limited because:\n- Exploitation requires a malicious tarball to be processed\n- File writes are restricted to sibling directories with matching prefixes (not arbitrary paths)\n- Packages from trusted sources (dbt Hub) are not affected\n\nThis is similar to CVE-2026-1703 in pip, which had a CVSS score of 3.9 (Low).\n\n### Patches\n_Has the problem been patched? What versions should users upgrade to?_\n\nFixed in `dbt-common` version 1.37.3 \u0026 1.34.2, and patched for dbt-core 1.11.7 and 1.10.20 releases.\n\nThe fix replaces `os.path.commonprefix()` with `os.path.commonpath()`, which correctly compares paths by their components rather than characters.\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\n\n- Only install dbt packages from trusted sources (official dbt Hub, verified git repositories)\n- Avoid installing packages from untrusted URLs or unverified third parties\n- Review package contents before installation when sourcing from external locations\n\n### Resources\n_Are there any links users can visit to find out more?_\n\n1. CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027): https://cwe.mitre.org/data/definitions/22.html\n2. CVE-2026-1703 (similar vulnerability in pip): https://nvd.nist.gov/vuln/detail/CVE-2026-1703\n3. pip fix PR #13777: https://github.com/pypa/pip/pull/13777\n4. Python documentation on `commonpath` vs `commonprefix`: https://docs.python.org/3/library/os.path.html#os.path.commonpath",
  "id": "GHSA-w75w-9qv4-j5xj",
  "modified": "2026-03-06T22:51:40Z",
  "published": "2026-03-05T00:59:10Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/dbt-labs/dbt-common/security/advisories/GHSA-w75w-9qv4-j5xj"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-29790"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/pip/pull/13777"
    },
    {
      "type": "WEB",
      "url": "https://github.com/dbt-labs/dbt-common/commit/e547954a48bac9394ef6eb98432e429dce9a7709"
    },
    {
      "type": "WEB",
      "url": "https://docs.python.org/3/library/os.path.html#os.path.commonpath"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-6vgw-5pg2-w6jp"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/dbt-labs/dbt-common"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "dbt-common\u0027s commonprefix() doesn\u0027t protect against path traversal"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

PYSEC-2026-2440

Impact

Patches

Workarounds

Resources

CVE-2026-29790 (GCVE-0-2026-29790)

GHSA-W75W-9QV4-J5XJ

Impact

Patches

Workarounds

Resources

Tags

Sightings

Nomenclature