dbt-core

dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications.

View on Pypi

View on Github

Activity

Latest release: 5d ago
Total releases: 363
Cadence: ~daily
Last 12 months: 64

Reach

Stars: 13.8k

Details

License: Apache-2.0
First release: Feb 14, 2019

Releases

Version	Released
`2.0.0rc2` pre	Sep 08, 2026
`1.12.4` patch	Sep 08, 2026
`1.11.15` patch	Sep 08, 2026
`2.0.0rc1` pre	Sep 02, 2026
`1.12.3` patch	Aug 21, 2026
`1.11.14` patch	Aug 20, 2026
`2.0.0b2` pre	Aug 18, 2026
`1.2.7` patch 1 CVE	Aug 14, 2026
`1.1.6` patch 1 CVE	Aug 14, 2026
`1.3.8` patch 1 CVE	Aug 14, 2026
`1.4.10` patch 1 CVE	Aug 14, 2026
`1.5.12` patch 1 CVE	Aug 14, 2026
`1.6.19` patch	Aug 14, 2026
`1.7.20` patch	Aug 14, 2026
`1.8.10` patch	Aug 14, 2026
`1.9.11` patch	Aug 13, 2026
`1.12.2` patch	Aug 12, 2026
`1.10.23` patch	Aug 12, 2026
`1.11.13` patch	Aug 12, 2026
`1.12.1` patch	Aug 12, 2026
`2.0.0b1` pre	Aug 10, 2026
`2.0.0a5` pre	Jul 20, 2026
`1.12.0` minor	Jul 16, 2026
`1.12.0rc3` pre	Jul 14, 2026
`1.12.0rc2` pre	Jul 09, 2026
`1.12.0rc1` pre	Jul 07, 2026
`2.0.0a4` pre	Jul 06, 2026
`1.11.12` patch	Jul 01, 2026
`2.0.0a3` pre	Jun 29, 2026
`2.0.0a2` pre	Jun 18, 2026
`1.12.0b3` pre	Jun 15, 2026
`1.12.0b2` pre	Jun 01, 2026
`2.0.0a1` pre	Jun 01, 2026
`1.11.11` patch	May 20, 2026
`1.10.22` patch	May 20, 2026
`1.10.21` patch	May 14, 2026
`1.11.10` patch	May 14, 2026
`1.12.0b1` pre	May 13, 2026
`1.11.9` patch	May 06, 2026
`1.11.8` patch	Apr 08, 2026
`1.11.7` patch	Mar 04, 2026
`1.10.20` patch	Mar 03, 2026
`1.11.6` patch	Feb 17, 2026
`1.11.5` patch	Feb 13, 2026
`1.11.4` patch	Feb 09, 2026
`1.11.3` patch	Feb 05, 2026
`1.10.19` patch	Jan 20, 2026
`1.10.18` patch	Jan 06, 2026
`1.11.2` patch	Dec 22, 2025
`1.11.2rc1` pre	Dec 22, 2025

1–50 of 363

Repository

dbt-labs/dbt-core

Forks: 2.6k
Open issues: 1.3k
Language: Rust
: 6.0/ 10

dbt-viewpoint
slack
pypa
data-modeling
business-intelligence
analytics

Dependencies (1)

Depends on

2.0.0rc2

Supply-chain exposure

Known CVEs (4)

CVE-2024-36105 PYSEC-2026-1292 GHSA-pmrx-695r-4349 Jul 07, 2026

dbt allows Binding to an Unrestricted IP Address via socketsocket

5.3 / 10
Medium
Network Low None None Unchanged Low None None

Summary

Binding to INADDR_ANY (0.0.0.0) or IN6ADDR_ANY (::) exposes an application on all network interfaces, increasing the risk of unauthorized access.

While doing some static analysis and code inspection, I found the following code binding a socket to INADDR_ANY by passing "" as the address. This effectively binds to any network interface on the local system, not just localhost (127.0.0.1).

Details

As stated in the Python docs, a special form for address is accepted instead of a host address: '' represents INADDR_ANY, equivalent to "0.0.0.0". On systems with IPv6, '' represents IN6ADDR_ANY, which is equivalent to "::".

https://github.com/dbt-labs/dbt-core/blob/main/core/dbt/task/docs/serve.py#L23C38-L23C39

The text around this code also imply the intention is to host docs only on localhost.

PoC

To recreate, run the docs ServeTask.run() to stand up the HTTP server. Then run netstat to see what addresses this process is bound.

Impact

A user who serves docs on an unsecured public network, may unknowingly be hosting an unsecured (http) web site for any remote user/system to access on the same network.

Further references: https://docs.python.org/3/library/socket.html#socket-families https://docs.securesauce.dev/rules/PY030 https://cwe.mitre.org/data/definitions/1327.html

Patches

The issue has has been mitigated in dbt-core v1.6.15, dbt-core v1.7.15, and dbt-core v1.8.1 by binding to localhost explicitly by default in dbt docs serve (https://github.com/dbt-labs/dbt-core/issues/10209).

Affected versions

0.13.00.13.0a10.13.0a20.13.0rc10.13.10.13.1a10.13.1a20.14.00.14.0a10.14.0a20.14.0rc10.14.1

+ 225 more Show less

0.14.1a10.14.1rc10.14.1rc20.14.20.14.30.14.3rc10.14.40.15.00.15.0b10.15.0b20.15.0b30.15.0rc10.15.0rc20.15.10.15.1rc10.15.1rc20.15.20.15.30.15.3rc10.16.00.16.0b10.16.0b20.16.0b30.16.0rc10.16.0rc20.16.0rc30.16.0rc40.16.10.16.1rc10.17.00.17.0b10.17.0b20.17.0rc10.17.0rc20.17.0rc30.17.0rc40.17.10.17.1rc10.17.1rc20.17.1rc30.17.1rc40.17.20.17.2b10.17.2rc10.18.00.18.0b10.18.0b20.18.0rc10.18.0rc20.18.10.18.1b10.18.1b20.18.1b30.18.1rc10.18.20.18.2rc10.19.00.19.0b10.19.0rc10.19.0rc20.19.0rc30.19.10.19.1b20.19.1rc10.19.1rc20.19.20.19.2rc10.19.2rc20.20.00.20.0b10.20.0rc10.20.0rc20.20.10.20.1rc10.20.20.20.2rc10.20.2rc20.21.00.21.0b10.21.0b20.21.0rc10.21.0rc20.21.10.21.1rc10.21.1rc21.0.01.0.0b11.0.0b21.0.0rc11.0.0rc21.0.0rc31.0.11.0.1rc11.0.21.0.2rc11.0.31.0.41.0.51.0.5rc11.0.5rc21.0.5rc31.0.61.0.6rc11.0.71.0.81.0.91.1.01.1.0b11.1.0rc11.1.0rc21.1.0rc31.1.11.1.1rc11.1.1rc21.1.21.1.2rc11.1.31.1.41.1.51.2.01.2.0b11.2.0rc11.2.0rc21.2.11.2.1rc11.2.1rc21.2.21.2.31.2.41.2.51.2.61.3.01.3.0b11.3.0b21.3.0rc11.3.0rc21.3.11.3.21.3.2rc11.3.31.3.41.3.51.3.61.3.71.4.01.4.0b11.4.0rc11.4.0rc21.4.11.4.21.4.2rc11.4.2rc21.4.31.4.41.4.51.4.61.4.71.4.81.4.91.5.01.5.0b11.5.0b21.5.0b31.5.0b41.5.0b51.5.0rc11.5.0rc21.5.11.5.101.5.111.5.1rc11.5.1rc21.5.21.5.2rc11.5.2rc21.5.31.5.41.5.4rc11.5.51.5.61.5.71.5.81.5.91.6.01.6.0b11.6.0b21.6.0b31.6.0b41.6.0b51.6.0b61.6.0b71.6.0b81.6.0rc11.6.0rc21.6.11.6.101.6.111.6.121.6.131.6.141.6.1rc11.6.21.6.31.6.41.6.51.6.61.6.71.6.81.6.91.7.01.7.11.7.101.7.111.7.121.7.131.7.141.7.21.7.31.7.41.7.51.7.61.7.71.7.81.7.91.8.0

Fixed in

1.6.151.7.151.8.1

References

https://github.com/dbt-labs/dbt-core/security/advisories/GHSA-pmrx-695r-4349
https://nvd.nist.gov/vuln/detail/CVE-2024-36105
https://github.com/dbt-labs/dbt-core/issues/10209
https://github.com/dbt-labs/dbt-core/pull/10208
https://github.com/dbt-labs/dbt-core/commit/0c08d7a19ad1740be3cb0b2e6d9d64f6537176f7
https://cwe.mitre.org/data/definitions/1327.html

Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-40637 GHSA-p3f3-5ccg-83xq PYSEC-2024-66 Jul 17, 2024

dbt has an implicit override for built-in materializations from installed packages

Low
Local Low Low

Impact

What kind of vulnerability is it? Who is impacted?

When a user installs a package in dbt, it has the ability to override macros, materializations, and other core components of dbt. This is by design, as it allows packages to extend and customize dbt's functionality. However, this also means that a malicious package could potentially override these components with harmful code.

Patches

Has the problem been patched? What versions should users upgrade to?

Fixed on 1.8.0, and patched for 1.6.14 and 1.7.14 releases.

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

Previously, a materialization defined in a package that shared a name with one of the built-in materializations would be preferred by default, without user action which is surprising and makes it more difficult to detect the insecure behaviour. We've changed the default behaviour to require explicit overrides by users in 1.8.0, and provided the ability to opt-out of built-in materialization overrides in 1.6 and 1.7 via the flags.require_explicit_package_overrides_for_builtin_materializations: False configuration in dbt_project.yml

Versions older than 1.6 are EOL.

References

Are there any links users can visit to find out more?

dbt documentation: https://docs.getdbt.com/reference/global-configs/legacy-behaviors#behavior-change-flags

https://www.elementary-data.com/post/are-dbt-packages-secure-the-answer-lies-in-your-dwh-policies

https://www.equalexperts.com/blog/tech-focus/are-you-at-risk-from-this-critical-dbt-vulnerability/

https://tempered.works/posts/2024/07/06/preventing-data-theft-with-gcp-service-controls/

Affected versions

1.6.01.6.11.6.101.6.111.6.121.6.131.6.1rc11.6.21.6.31.6.41.6.51.6.6

+ 17 more Show less

1.6.71.6.81.6.91.7.01.7.11.7.101.7.111.7.121.7.131.7.21.7.31.7.41.7.51.7.61.7.71.7.81.7.9

Fixed in

1.6.141.7.14

References

https://github.com/dbt-labs/dbt-core/security/advisories/GHSA-p3f3-5ccg-83xq
https://nvd.nist.gov/vuln/detail/CVE-2024-40637
https://github.com/dbt-labs/dbt-core/commit/3c82a0296d227cb1be295356df314c11716f4ff6
https://github.com/dbt-labs/dbt-core/commit/87ac4deb00cc9fe334706e42a365903a1d581624
https://docs.getdbt.com/docs/build/packages
https://docs.getdbt.com/reference/global-configs/legacy-behaviors#behavior-change-flags

Updated Sep 10, 2026 · Source: OSV.dev
GHSA-p72q-h37j-3hq7 Apr 22, 2024

dbt uses a SQLparse version with a high vulnerability

7.5 / 10
High
Network Low None None Unchanged None None High

Summary

Using a version of sqlparse that has a security vulnerability and no way to update in current version of dbt core. Snyk recommends using sqlparse==0.5 but this causes a conflict with dbt. Snyk states the issues is a recursion error: SNYK-PYTHON-SQLPARSE-6615674.

Details

Dependency conflict error message:

The conflict is caused by: The user requested sqlparse==0.5 dbt-core 1.7.10 depends on sqlparse<0.5 and >=0.2.3

Resolution was to pin sqlparse >=0.5.0, <0.6.0 in dbt-core, patched in 1.6.13 and 1.7.13.

PoC

From Snyk:

import sqlparse sqlparse.parse('[' * 10000 + ']' * 10000)

Impact

Snyk classifies it as high 7.5/10.

Patches

The bug has been fixed in dbt-core v1.6.13 and dbt-core v1.7.13.

Mitigations

Bump dbt-core 1.6 and 1.7 dependencies to 1.6.13 and 1.7.13 respectively

Affected versions

1.6.01.6.11.6.101.6.111.6.121.6.1rc11.6.21.6.31.6.41.6.51.6.61.6.7

+ 15 more Show less

1.6.81.6.91.7.01.7.11.7.101.7.111.7.121.7.21.7.31.7.41.7.51.7.61.7.71.7.81.7.9

Fixed in

1.6.131.7.13

References

https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-2m57-hf25-phgg
https://github.com/dbt-labs/dbt-core/security/advisories/GHSA-p72q-h37j-3hq7
https://github.com/dbt-labs/dbt-core
https://security.snyk.io/vuln/SNYK-PYTHON-SQLPARSE-6615674

Updated Dec 05, 2024 · Source: OSV.dev
GHSA-j4g3-3q8x-jxqp Dec 08, 2023

dbt-core's secret env vars written to package-lock.json in plaintext

3.2 / 10
Low
Local Low Low Required Changed Low None None

Impact

When used to pull source code from a private repository using a Personal Access Token (PAT), some versions of dbt-core write a URL with the PAT in plaintext to the package-lock.yml file.

Patches

The bug has been fixed in dbt-core v1.7.3.

Mitigations

Remove any git URLs with plaintext secrets from package-lock.yml file(s) on servers, workstations, or in source control. Rotate any tokens that have been written to version-controlled files.

Affected versions

1.7.01.7.11.7.2

Fixed in

1.7.3

References

https://github.com/dbt-labs/dbt-core/security/advisories/GHSA-j4g3-3q8x-jxqp
https://github.com/dbt-labs/dbt-core/commit/09f5bb3dcffeda7a60ad2b22c2891f237628ecd1
https://github.com/dbt-labs/dbt-core
https://github.com/dbt-labs/dbt-core/releases/tag/v1.7.3

Updated Dec 04, 2024 · Source: OSV.dev

Insights

Releases per month

last 12 months

Release mix

major 1
minor 20
patch 172
pre 169

363 releases

Dependencies over time

per release

Release calendar

2026

Jan

Feb

Mar

Apr

May

Jun

Jul

Aug

Sep

Oct

Nov

Dec

Less More