Path Traversal Vulnerability in dbt-common: Exploitable Extraction Flaw
Summary
GHSA-w75w-9qv4-j5xj: dbt-common's commonprefix() doesn't protect against path traversal. Affects dbt-common across 2 version ranges.
< 1.34.2
>= 1.35.0, < 1.37.3
Fixed in 1.34.2 or 1.37.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
dbt-common is a Python package that provides common utilities for the dbt (data build tool) ecosystem, facilitating the extraction and management of data packages. It is widely used for data transformation and analytics workflows. However, a critical vulnerability has been identified in its safe_extract() function, which is responsible for extracting tarball archives. This vulnerability allows malicious tarballs to exploit the package's path handling, potentially leading to unauthorized file writes outside the intended directory.
Vulnerability Detail
A path traversal vulnerability exists in dbt-common's safe_extract() function due to the improper use of os.path.commonprefix(). This function compares paths character-by-character instead of by their components, allowing a crafted tarball to write files to sibling directories that share matching prefixes. For example, extracting to '/tmp/packages' could allow a malicious tarball to write to '/tmp/packagesevil/' if the names match in the prefix. This vulnerability primarily affects users who install dbt packages from untrusted sources or process tarball archives through dbt-common's utilities. The risk is somewhat mitigated as exploitation requires a malicious tarball, and affected writes are limited to sibling directories, not arbitrary paths.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.34.21.34.2pip install --upgrade "dbt-common==1.34.2" -
>= 1.35.0, < 1.37.31.37.3pip install --upgrade "dbt-common==1.37.3"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, users are advised to only install dbt packages from trusted sources, such as the official dbt Hub or verified git repositories. Avoid installing packages from untrusted URLs or unverified third parties, and review package contents before installation when sourcing from external locations.
Conclusion
In summary, a path traversal vulnerability in dbt-common's extraction function poses a risk to users who handle tarball archives from untrusted sources. Upgrading to the latest patched versions and adhering to best practices for package installation can mitigate this risk effectively.
See every vulnerability recorded for dbt-common →
FAQ
The vulnerability is a path traversal issue that allows malicious tarballs to write files to unintended directories.
Users who install dbt packages from untrusted sources or process tarball archives through dbt-common's utilities are at risk.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation could lead to unauthorized file writes in sibling directories, potentially compromising the integrity of the file system.
The CVSS score of this vulnerability is 2.0, indicating a low severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for dbt-common.
