dbt Core security advisories
4 advisories · none critical or high in 12 months · latest Jul 17, 2024
4 advisories
| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Jul 172024 | dbt has an implicit override for built-in materializations from installed packages CVE-2024-40637Low4.2fixed in 1.6.14, 1.7.14 | Low4.2 | 1.6.14, 1.7.14 |
| May 282024 | dbt allows Binding to an Unrestricted IP Address via socketsocket CVE-2024-36105Medium5.3fixed in 1.6.15, 1.7.15, 1.8.1 | Medium5.3 | 1.6.15, 1.7.15, 1.8.1 |
| Apr 222024 | dbt uses a SQLparse version with a high vulnerability GHSA-p72q-h37j-3hq7High7.5fixed in 1.6.13, 1.7.13 | High7.5 | 1.6.13, 1.7.13 |
| Dec 82023 | dbt-core's secret env vars written to package-lock.json in plaintext GHSA-j4g3-3q8x-jxqpLow3.2fixed in 1.7.3 | Low3.2 | 1.7.3 |