What is CVE-2026-29790?

CVE-2026-29790 is a low-severity path traversal vulnerability in dbt-common (pip), affecting versions < 1.34.2. It is fixed in 1.34.2, 1.37.3. Input manipulates file paths to reach files outside the intended directory, such as configuration or credential files.

Which versions of dbt-common are affected by CVE-2026-29790?

dbt-common (pip) versions < 1.34.2 is affected.

Is there a fix for CVE-2026-29790?

Yes. CVE-2026-29790 is fixed in 1.34.2, 1.37.3. Upgrade to this version or later.

Is CVE-2026-29790 exploitable, and should I be worried?

Whether CVE-2026-29790 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk.

What actually determines whether CVE-2026-29790 is exploitable, and how bad it is?

Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.

How do I fix CVE-2026-29790?

Upgrade: dbt-common to 1.34.2 or later, dbt-common to 1.37.3 or later.

CVE-2026-29790 in dbt-common

Q: Which versions of dbt-common are affected by CVE-2026-29790?

dbt-common (pip) versions < 1.34.2 is affected.

Q: Is there a fix for CVE-2026-29790?

Yes. CVE-2026-29790 is fixed in 1.34.2, 1.37.3. Upgrade to this version or later.

Q: Is CVE-2026-29790 exploitable, and should I be worried?

Whether CVE-2026-29790 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk.

Q: What actually determines whether CVE-2026-29790 is exploitable, and how bad it is?

Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.

Q: How do I fix CVE-2026-29790?

Upgrade: dbt-common to 1.34.2 or later, dbt-common to 1.37.3 or later.

Summary

dbt-common's commonprefix() doesn't protect against path traversal

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

Only install dbt packages from trusted sources (official dbt Hub, verified git repositories)
Avoid installing packages from untrusted URLs or unverified third parties
Review package contents before installation when sourcing from external locations

Resources

Are there any links users can visit to find out more?

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): https://cwe.mitre.org/data/definitions/22.html
CVE-2026-1703 (similar vulnerability in pip): https://nvd.nist.gov/vuln/detail/CVE-2026-1703
pip fix PR #13777: https://github.com/pypa/pip/pull/13777
Python documentation on commonpath vs commonprefix: https://docs.python.org/3/library/os.path.html#os.path.commonpath

Impact

What kind of vulnerability is it? Who is impacted?

A path traversal vulnerability exists in dbt-common's safe_extract() function used when extracting tarball archives. The function uses os.path.commonprefix() to validate that extracted files remain within the intended destination directory. However, commonprefix() compares paths character-by-character rather than by path components, allowing a malicious tarball to write files to sibling directories with matching name prefixes.

For example, when extracting to /tmp/packages, a crafted tarball could write files to /tmp/packagesevil/ by exploiting the character-based prefix matching.

This vulnerability affects users who:

Install dbt packages from untrusted sources
Process tarball archives through dbt-common's extraction utilities

The practical risk is limited because:

Exploitation requires a malicious tarball to be processed
File writes are restricted to sibling directories with matching prefixes (not arbitrary paths)
Packages from trusted sources (dbt Hub) are not affected

This is similar to CVE-2026-1703 in pip, which had a CVSS score of 3.9 (Low).

Input manipulates file paths to reach files outside the intended directory, such as configuration or credential files. Typical impact: unauthorized file read or write outside the intended directory.

Affected versions

dbt-common (< 1.34.2) dbt-common (>= 1.35.0, < 1.37.3)

Security releases

dbt-common → 1.34.2 (pip) dbt-common → 1.37.3 (pip)

Kodem intelligence

Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.

Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.

Already deployed Kodem?

See it in your environment New to Kodem? Get a demo →

Remediation advice

Has the problem been patched? What versions should users upgrade to?

Fixed in dbt-common version 1.37.3 & 1.34.2, and patched for dbt-core 1.11.7 and 1.10.20 releases.

The fix replaces os.path.commonprefix() with os.path.commonpath(), which correctly compares paths by their components rather than characters.

Frequently Asked Questions

What is CVE-2026-29790? CVE-2026-29790 is a low-severity path traversal vulnerability in dbt-common (pip), affecting versions < 1.34.2. It is fixed in 1.34.2, 1.37.3. Input manipulates file paths to reach files outside the intended directory, such as configuration or credential files.
Which versions of dbt-common are affected by CVE-2026-29790? dbt-common (pip) versions < 1.34.2 is affected.
Is there a fix for CVE-2026-29790? Yes. CVE-2026-29790 is fixed in 1.34.2, 1.37.3. Upgrade to this version or later.
Is CVE-2026-29790 exploitable, and should I be worried? Whether CVE-2026-29790 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
What actually determines whether CVE-2026-29790 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
How do I fix CVE-2026-29790?
- Upgrade dbt-common to 1.34.2 or later
- Upgrade dbt-common to 1.37.3 or later