CVE-2024-40637
MediumCVSS 4.2Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
dbt enables data analysts and engineers to transform data. When a user installs a package in dbt, it can override macros, materializations, and other core components by design, but a malicious package could override these with harmful code. This issue is fixed in versions 1.8.0, 1.6.14, and 1.7.14.
Risk Assessment
A malicious package could execute arbitrary code within the dbt environment, leading to data and system compromise. Organizations using dbt are exposed to supply chain attacks.
Recommendation
Upgrade dbt to version 1.8.0, 1.6.14, or 1.7.14. When updating to 1.6.14 or 1.7.14, set flags.require_explicit_package_overrides_for_builtin_materializations: False in dbt_project.yml.
Other vulnerabilities in dbt
See all- CVE-2026-39382Critical
In dbt's reusable workflow open-issue-in-repo.yml, the output steps.issue_comment.outputs.comment-body is interpolated directly into a bash if statement without escaping. An attacker can inject arbitrary shell commands via a malicious comment.
- CVE-2026-100406High
dbt versions 2.0.0-alpha.0 through 2.0.0-alpha.5 expose an unauthenticated POST /api/v1/query endpoint in dbt docs serve, which passes caller-supplied SQL to DuckDbViewsBackend::query_arrow() without authorization or an allowlist. A client that can reach the server can invoke DuckDB filesystem-reading functions to read files available to the dbt process, including files outside the docs index directory.
Original NVD description (English source)
dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. When a user installs a package in dbt, it has the ability to override macros, materializations, and other core components of dbt. This is by design, as it allows packages to extend and customize dbt's functionality. However, this also means that a malicious package could potentially override these components with harmful code. This issue has been fixed in versions 1.8.0, 1.6.14 and 1.7.14. Users are advised to upgrade. There are no kn own workarounds for this vulnerability. Users updating to either 1.6.14 or 1.7.14 will need to set `flags.require_explicit_package_overrides_for_builtin_materializations: False` in their configuration in `dbt_project.yml`.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS