What’s Vulnerable › Products

dbt-labs dbt-core vulnerabilities

3 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 2 published in the last 12 months.

Check whether your dbt-labs dbt-core version is affected

Latest dbt-labs dbt-core vulnerabilities

• CVE-2026-100406 — dbt: Unauthenticated Arbitrary SQL Execution in `dbt docs serve` (CVSS 8.2)
• CVE-2026-39382 — dbt has a Command Injection in Reusable Workflow via Unsanitized comment-body Output (CVSS 9.3)