CVE-2026-44968

Katalog CVE

CVSS 6.3 · Medium EPSS 0,21%

Kerentanan Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') pada getdbt dbt mcp server. Skor CVSS 3.1 6.3 (Medium) menurut github.com.

Deskripsi (NVD)

dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.17.1, _run_dbt_command() in src/dbt_mcp/dbt_cli/tools.py appended unsanitized node_selection and resource_type values to the dbt subprocess argument list, allowing an MCP client to inject dbt global flags such as --profiles-dir, --project-dir, and --target into subprocess.Popen even though shell=False prevents shell metacharacter injection. This issue is fixed in version 1.17.1.

Rincian

Terbit di NVD

16 Juli 2026

Terakhir diubah

21 Juli 2026

Status NVD

Analyzed

CVSS 3.1

6.3 (Medium), sumber github.com
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

EPSS (30 hari)

0,21% peluang dieksploitasi; lebih tinggi dari 9,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/dbt-labs/dbt-mcp/security/advisories/GHSA-xpww-f6pm-cfhq exploit · mitigasi · advisory vendor
• https://github.com/dbt-labs/dbt-mcp/commit/6534507b5e7a729758d5baece155602cad0bb22f patch
• https://github.com/dbt-labs/dbt-mcp/pull/752 issue tracking · patch
• https://github.com/dbt-labs/dbt-mcp/releases/tag/v1.17.1 release notes