PyPI/dbt-common CVE-2026-29790: medium 5.3, EPSS 0.28%

dbt-common's commonprefix() doesn't protect against path traversal

Action: Upgrade dbt-common to 1.34.2 or later.

pip install dbt-common==1.34.2

pip install dbt-common==1.37.3

Affected

Fixed versions

Sources

• osv: PYSEC-2026-2440
• nvd: CVE-2026-29790
• https://github.com/dbt-labs/dbt-common/security/advisories/GHSA-w75w-9qv4-j5xj
• https://github.com/pypa/pip/pull/13777
• https://github.com/dbt-labs/dbt-common/commit/e547954a48bac9394ef6eb98432e429dce9a7709
• https://docs.python.org/3/library/os.path.html#os.path.commonpath
• https://github.com/advisories/GHSA-6vgw-5pg2-w6jp
• https://github.com/dbt-labs/dbt-common
• https://pypi.org/project/dbt-common
• https://github.com/advisories/GHSA-w75w-9qv4-j5xj

CVE-2026-29790 · published 2026-07-13T14:36:40.777932Z · modified 2026-07-13T16:31:42.929992505Z · JSON