| Gói / sản phẩm | Phiên bản bị ảnh hưởng | Phiên bản đã vá |
|---|---|---|
| dbt-common | ≥ 1.35.0, < 1.37.3< 1.34.2 | 1.37.31.34.2 |
| dbt-common | ≥ 1.35.0, < 1.37.3< 1.34.2 | 1.37.31.34.2 |
What kind of vulnerability is it? Who is impacted?
A path traversal vulnerability exists in dbt-common's safe_extract() function used when extracting tarball archives. The function uses os.path.commonprefix() to validate that extracted files remain within the intended destination directory. However, commonprefix() compares paths character-by-character rather than by path components, allowing a malicious tarball to write files to sibling directories with matching name prefixes.
For example, when extracting to /tmp/packages, a crafted tarball could write files to /tmp/packagesevil/ by exploiting the character-based prefix matching.
This vulnerability affects users who:
The practical risk is limited because:
This is similar to CVE-2026-1703 in pip, which had a CVSS score of 3.9 (Low).
Has the problem been patched? What versions should users upgrade to?
Fixed in dbt-common version 1.37.3 & 1.34.2, and patched for dbt-core 1.11.7 and 1.10.20 releases.
The fix replaces os.path.commonprefix() with os.path.commonpath(), which correctly compares paths by their components rather than characters.
Is there a way for users to fix or remediate the vulnerability without upgrading?
Are there any links users can visit to find out more?
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phícommonpath vs commonprefix: https://docs.python.org/3/library/os.path.html#os.path.commonpath