CVE-2026-29790
2 advisories.
PyPI/dbt-common CVE-2026-29790: low, EPSS 0.40%
dbt-common's commonprefix() doesn't protect against path traversal
Action: Upgrade dbt-common to 1.34.2 or later.
pip install dbt-common==1.34.2pip install dbt-common==1.37.3Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.34.2 | - |
| 1.35.0 | 1.37.3 | - |
Fixed versions
| 1.34.2 | 1.37.3 |
Sources
- osv: GHSA-w75w-9qv4-j5xj
- https://github.com/dbt-labs/dbt-common/security/advisories/GHSA-w75w-9qv4-j5xj
- https://nvd.nist.gov/vuln/detail/CVE-2026-29790
- https://github.com/pypa/pip/pull/13777
- https://github.com/dbt-labs/dbt-common/commit/e547954a48bac9394ef6eb98432e429dce9a7709
- https://docs.python.org/3/library/os.path.html#os.path.commonpath
- https://github.com/advisories/GHSA-6vgw-5pg2-w6jp
- https://github.com/dbt-labs/dbt-common
CVE-2026-29790 · published · modified · JSON
PyPI/dbt-common CVE-2026-29790: unknown, EPSS 0.40%
dbt-common's commonprefix() doesn't protect against path traversal
Action: Upgrade dbt-common to 1.34.2 or later.
pip install dbt-common==1.34.2pip install dbt-common==1.37.3Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.34.2 | - |
| 1.35.0 | 1.37.3 | - |
Fixed versions
| 1.34.2 | 1.37.3 |
Sources
- osv: PYSEC-2026-2440
- https://github.com/dbt-labs/dbt-common/security/advisories/GHSA-w75w-9qv4-j5xj
- https://nvd.nist.gov/vuln/detail/CVE-2026-29790
- https://github.com/pypa/pip/pull/13777
- https://github.com/dbt-labs/dbt-common/commit/e547954a48bac9394ef6eb98432e429dce9a7709
- https://docs.python.org/3/library/os.path.html#os.path.commonpath
- https://github.com/advisories/GHSA-6vgw-5pg2-w6jp
- https://github.com/dbt-labs/dbt-common
- https://pypi.org/project/dbt-common
- https://github.com/advisories/GHSA-w75w-9qv4-j5xj
CVE-2026-29790 · published · modified · JSON