Shell Injection Vulnerability in dbt-Labs Product
CVE-2026-39382

9.3CRITICAL

Key Information:

Vendor

Dbt-labs

Status
Dbt-core
Vendor
CVE Published:
7 April 2026

What is CVE-2026-39382?

A shell injection vulnerability exists in dbt-Labs' reusable workflow for managing issues. The workflow allows user-controlled comments to be interpolated directly into shell commands. This could permit attackers to craft malicious comments that inject arbitrary shell commands into the system, potentially leading to unauthorized command execution within the environment. To ensure protection, users should update to the patched version based on commit bbed8d28354e9c644c5a7df13946a3a0451f9ab9.

Affected Version(s)

dbt-core < bbed8d28354e9c644c5a7df13946a3a0451f9ab9

References

https://github.com/dbt-labs/dbt-core/security/advisories/...
x_refsource_CONFIRM
https://github.com/dbt-labs/actions/commit/bbed8d28354e9c...
x_refsource_MISC

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.