🛡️ CVE-2026-29790 — dbt-common

🟢 CVSS 2.0 — Low ✅ No Known Exploit CWE-22 OSV
2.0
CVSS Score
0 Low4 Medium7 High9 Critical10

Description

dbt-common's commonprefix() doesn't protect against path traversal

Impact

_What kind of vulnerability is it? Who is impacted?_

A path traversal vulnerability exists in dbt-common's safe_extract() function used when extracting tarball archives. The function uses os.path.commonprefix() to validate that extracted files remain within the intended destination directory. However, commonprefix() compares paths character-by-character rather than by path components, allowing a malicious tarball to write files to sibling directories with matching name prefixes.

For example, when extracting to /tmp/packages, a crafted tarball could write files to /tmp/packagesevil/ by exploiting the character-based prefix matching.

This vulnerability affects users who:

  • Install dbt packages from untrusted sources
  • Process tarball archives through dbt-common's extraction utilities

The practical risk is limited because:

  • Exploitation requires a malicious tarball to be processed
  • File writes are restricted to sibling directories with matching prefixes (not arbitrary paths)
  • Packages from trusted sources (dbt Hub) are not affected

This is similar to CVE-2026-1703 in pip, which had a CVSS score of 3.9 (Low).

Patches

_Has the problem been patched? What versions should users upgrade to?_

Fixed in dbt-common version 1.37.3 & 1.34.2, and patched for dbt-core 1.11.7 and 1.10.20 releases.

The fix replaces os.path.commonprefix() with os.path.commonpath(), which correctly compares paths by their components rather than characters.

Workarounds

_Is there a way for users to fix or remediate the vulnerability without upgrading?_

  • Only install dbt packages from trusted sources (official dbt Hub, verified git repositories)
  • Avoid installing packages from untrusted URLs or unverified third parties
  • Review package contents before installation when sourcing from external locations

Resources

_Are there any links users can visit to find out more?_

1. CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): https://cwe.mitre.org/data/definitions/22.html

2. CVE-2026-1703 (similar vulnerability in pip): https://nvd.nist.gov/vuln/detail/CVE-2026-1703

3. pip fix PR #13777: https://github.com/pypa/pip/pull/13777

4. Python documentation on commonpath vs commonprefix: https://docs.python.org/3/library/os.path.html#os.path.commonpath

How this vulnerability can be exploited

This issue can be reached over the network, attack complexity is low, an attacker needs low-level privileges on the target. A user must actively cooperate. Rated impact: confidentiality none, integrity low, availability none.

Weakness class

CVE-2026-29790 is classified as CWE-22: Path Traversal. A file path built from user input is not confined to the intended directory, letting an attacker reach files elsewhere on the filesystem.

Affected software

CVE-2026-29790 is recorded against 1 package.

  • dbt-common (from 1.35.0 up to 1.37.3)

Timeline and source

Published on 5 March 2026 and last revised on 13 July 2026. No public exploit is currently recorded for this entry. A vendor advisory or fix has been published. Record sourced from OSV.

References

github.com (Web)
nvd.nist.gov (Advisory)
github.com (Web)
github.com (Web)
docs.python.org (Web)
github.com (Advisory)
github.com (Package)

Details

Severity LOW
CVSS Score 2.0
CVSS Vector CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
CWE CWE-22
Public Exploit ✅ No
Source OSV
Published 2026-03-05
Updated 2026-08-12
Modified 2026-07-13

Affected Packages

Software From version Fixed in
dbt-common 1.35.0 1.37.3

Free Vulnerability Check

Is your site affected by CVE-2026-29790?

BotEraser helps you identify potentially vulnerable plugins and themes by checking your installation against CVE-2026-29790 and other known CVE records.

Scan My Site Free →

No credit card required  ·  Results in minutes

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the vulnerabilities listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.