CVE-2026-39382
CriticalCVSS 9.3Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
In dbt's reusable workflow open-issue-in-repo.yml, the output steps.issue_comment.outputs.comment-body is interpolated directly into a bash if statement without escaping. An attacker can inject arbitrary shell commands via a malicious comment.
Risk Assessment
An attacker can remotely execute arbitrary commands in the context of the GitHub Actions workflow, potentially leading to repository compromise and sensitive data exposure.
Recommendation
Apply the fix from commit bbed8d28354e9c644c5a7df13946a3a0451f9ab9. Ensure all user input is properly escaped before use in shell scripts.
Original NVD description (English source)
dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. Inside the reusable workflow dbt-labs/actions/blob/main/.github/workflows/open-issue-in-repo.yml, the prep job uses peter-evans/find-comment to search for an existing comment indicating that a docs issue has already been opened. The output steps.issue_comment.outputs.comment-body is then interpolated directly into a bash if statement. Because comment-body is attacker-controlled text and is inserted into shell syntax without escaping, a malicious comment body can break out of the quoted string and inject arbitrary shell commands. This vulnerability is fixed with commit bbed8d28354e9c644c5a7df13946a3a0451f9ab9.