CVE-2026-39382
CriticalCVSS 9.3Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
In dbt's reusable workflow open-issue-in-repo.yml, the output steps.issue_comment.outputs.comment-body is interpolated directly into a bash if statement without escaping. An attacker can inject arbitrary shell commands via a malicious comment.
Risk Assessment
An attacker can remotely execute arbitrary commands in the context of the GitHub Actions workflow, potentially leading to repository compromise and sensitive data exposure.
Recommendation
Apply the fix from commit bbed8d28354e9c644c5a7df13946a3a0451f9ab9. Ensure all user input is properly escaped before use in shell scripts.
Other vulnerabilities in dbt
See all- CVE-2026-100406High
dbt versions 2.0.0-alpha.0 through 2.0.0-alpha.5 expose an unauthenticated POST /api/v1/query endpoint in dbt docs serve, which passes caller-supplied SQL to DuckDbViewsBackend::query_arrow() without authorization or an allowlist. A client that can reach the server can invoke DuckDB filesystem-reading functions to read files available to the dbt process, including files outside the docs index directory.
- CVE-2024-40637Medium
dbt enables data analysts and engineers to transform data. When a user installs a package in dbt, it can override macros, materializations, and other core components by design, but a malicious package could override these with harmful code. This issue is fixed in versions 1.8.0, 1.6.14, and 1.7.14.
Original NVD description (English source)
dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. Inside the reusable workflow dbt-labs/actions/blob/main/.github/workflows/open-issue-in-repo.yml, the prep job uses peter-evans/find-comment to search for an existing comment indicating that a docs issue has already been opened. The output steps.issue_comment.outputs.comment-body is then interpolated directly into a bash if statement. Because comment-body is attacker-controlled text and is inserted into shell syntax without escaping, a malicious comment body can break out of the quoted string and inject arbitrary shell commands. This vulnerability is fixed with commit bbed8d28354e9c644c5a7df13946a3a0451f9ab9.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS