dbt
v1.12.7dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications.
- Maintenance
- Active1426 commits in 3 months · bus factor 12
- License
- Apache-2.0Permissive · OSI-approved
- Security
- 10 advisories1 critical, 5 high, 3 medium, 1 low
- Supported versions
- 3 lines supportednewest 2.0 · oldest 1.11 until Dec 19, 2026 · 9 ended
14.2k stars · 2.7k forks · 1.9k open issues · last release 3 days ago · data checked 1 hour ago
Security advisories
All advisories on GitHubThe 10 most recent advisories published by the maintainers: 1 critical, 5 high, 3 medium, 1 low. Check the patched version against the one you run.
- highGHSA-xwgp-43x8-639jOct 14, 2026Transitive tarball name escapes download directory and overwrites files
- Affected
- < 1.12.6; <1.11.16
- Patched in
- 1.12.6; 1.11.16
- mediumGHSA-wfxc-3pjp-fm6hSep 3, 2026Security disclosure: vulnerable astral-tokio-tar pin enables creating extra files via `dbt deps`
- Affected
- < v2.0.0-alpha.5
- Patched in
- 2.0.0-rc.1
- highGHSA-h364-2v3g-4xm8Sep 3, 2026`dbt deps` symlink traversal enables arbitrary file write/overwrite outside `dbt_packages`
- Affected
- < v2.0.0-alpha.5
- Patched in
- 2.0.0-rc.1
- highGHSA-pxwq-479r-hhwrAug 21, 2026DoS in dbt Core SQL compilation via pinned vulnerable sqlparse parser
- Affected
- <0.11.14 and <1.12.3
- Patched in
- 1.11.4 and 1.12.3
- highCVE-2026-100406Jul 22, 2026Unauthenticated Arbitrary SQL Execution in `dbt docs serve`
- Affected
- >= 2.0.0-alpha.0, <= 2.0.0-alpha.1
- Patched in
- 2.0.0-alpha.5
- criticalCVE-2026-39382Apr 6, 2026Command Injection in Reusable Workflow via Unsanitized comment-body Output
- Affected
- NA
- mediumCVE-2024-40637Jul 16, 2024Implicit override for built-in materializations from installed packages
- Affected
- 1.6, 1.7
- Patched in
- 1.6.14, 1.7.14
- mediumCVE-2024-36105May 27, 2024Binding to an Unrestricted IP Address via socketsocket
- Affected
- 1.6.114, 1.7.14, 1.8.0
- Patched in
- 1.6.15, 1.7.15, 1.8.1
- highGHSA-p72q-h37j-3hq7Apr 22, 2024sqlparse version high vulnerability
- Affected
- 1.6, 1.7
- Patched in
- 1.6.13, 1.7.13
- lowGHSA-j4g3-3q8x-jxqpDec 8, 2023Secret env vars written to package-lock.json in plaintext
- Affected
- >=1.7.0, <1.7.3
- Patched in
- >=1.7.3