VulnSocial

CVE-2026-29790Disclosure(getdbt / dbt-common)

LOWCVSS 5.3 · MEDIUM

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

dbt-common is the shared common utilities for dbt-core and adapter implementations use. Prior to versions 1.34.2 and 1.37.3, a path traversal vulnerability exists in dbt-common's safe_extract() function used when extracting tarball archives. The function uses os.path.commonprefix() to validate that extracted files remain within the intended destination directory. However, commonprefix() compares paths character-by-character rather than by path components, allowing a malicious tarball to write files to sibling directories with matching name prefixes. This issue has been patched in versions 1.34.2 and 1.37.3.

getdbt CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Patch / fix
Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-22

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • dbt-common

Threat summary

  • 3 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Technical details provided in 3 signals
  • Disclosure: 3 classified signals
  • Peaked at 2 mentions on most recent observed day (2026-03-07)
  • 3 total mentions across 2 days

Affected systems

Vendors
getdbt
Products
dbt-common

Deep dive

Activity timeline3 mentions / 2d
01122Mentions · 2026-03-06: 1Mentions · 2026-03-07: 2Technical Details · 2026-03-06: 1Technical Details · 2026-03-07: 203-0603-07
Signal classification1 categories
Disclosure
3100.0%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-03-061
Disclosure1
2026-03-072
Disclosure2
Full discourse3 posts
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-29790 Path Traversal Vulnerability in dbt-common Tarball Extraction Function https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-29790

    Post summary

    The post announces a path‑traversal vulnerability (CVE‑2026‑29790) in dbt‑common’s tarball extraction function, providing technical details but no evidence of PoC, exploitation, patch, or debunking.

    0001050
    4.0K followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-29790 dbt-common is the shared common utilities for dbt-core and adapter implementations use. Prior to versions 1.34.2 and 1.37.3, a path traversal vulnerability exists in … https://www.cve.org/CVERecord?id=CVE-2026-29790

    Post summary

    CVE-2026-29790 is a path traversal vulnerability in dbt-common that affects all versions prior to 1.34.2 and 1.37.3.

    0000096
    56.6K followersView on X
  • CyberDudeBivash® | Global Cybersecurity Company@cyberbivash
    Disclosure

    🚨 CYBERDUDEBIVASH SENTINEL APEX ALERT 🚨 Threat: CVE-2026-29790 - dbt-common: commonprefix() doesn't protect against path traversal Intel Report: https://ift.tt/vKuoF9O

    Post summary

    The tweet announces CVE-2026-29790, a path‑traversal vulnerability in dbt‑common caused by an inadequate commonprefix() function.

    0000034
    343 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appgetdbtdbt-common---

Explore more

Back to dashboardgetdbt CVEsdbt-common vulnerabilities