CVE-2024-40637

Advisory

When a user installs a package in dbt, they gain the capability to override macros, materializations, and other core components of dbt. This design feature enables packages to extend and customize dbt's functionality. However, it also allows a malicious package to replace these components with harmful code.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://github.com/advisories/GHSA-p3f3-5ccg-83xq
• https://github.com/dbt-labs/dbt-core/commit/3c82a0296d227cb1be295356df314c11716f4ff6
• https://github.com/dbt-labs/dbt-core/commit/87ac4deb00cc9fe334706e42a365903a1d581624
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-40637