CVE-2026-29790: 
Python vulnerability analysis and mitigation

CVE-2026-29790 is a path traversal vulnerability in the safe_extract() function of dbt-common, the shared utility library used by dbt-core and adapter implementations. The flaw allows a malicious tarball to write files outside the intended extraction directory into sibling directories with matching name prefixes. It affects dbt-common versions prior to 1.34.2 and versions 1.35.0 through 1.37.2. The advisory was published on March 4, 2026, with patches released on March 13, 2026. It carries a CVSS v3.1 base score of 5.3 (Medium) and a CVSS v4.0 score of 2.0 (Low) (GitHub Advisory, Red Hat CVE).

The root cause is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). The vulnerable safe_extract() function in dbt_common/clients/system.py used os.path.commonprefix() to validate that extracted tarball entries remain within the destination directory. Because commonprefix() performs character-by-character string comparison rather than path-component comparison, a crafted tarball entry path such as ../packages_evil/malicious.txt could pass validation when the destination is /tmp/packages, since the string prefix /tmp/packages matches both. The fix replaces os.path.commonprefix() with os.path.commonpath(), which correctly compares by path components and raises a ValueError for paths on different drives (Windows), failing safely (GitHub Commit, GitHub Advisory). This class of vulnerability is analogous to CVE-2026-1703 in pip, which was addressed with the same commonpath() fix (pip PR #13777).

Successful exploitation allows an attacker to write arbitrary files to sibling directories of the intended extraction target — for example, writing to /tmp/packagesevil/ when extracting to /tmp/packages/. This impacts integrity by enabling unauthorized file placement in locations outside the intended sandbox, potentially allowing injection of malicious files into adjacent dbt-core or adapter directories. Confidentiality and availability are not directly impacted. The practical risk is constrained because exploitation requires the victim to process a malicious tarball, and file writes are limited to sibling directories with matching name prefixes rather than arbitrary filesystem locations (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of this report (Red Hat CVE). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.043% (0.000430), indicating a very low probability of exploitation in the near term. Exploitation requires an attacker to supply a malicious tarball that a dbt user processes — most commonly by tricking a user into installing a package from an untrusted source (GitHub Advisory).

1. Craft a malicious tarball: Create a .tar.gz archive containing a file with a path designed to escape the extraction directory via sibling traversal, e.g., ../packages_evil/malicious.py. The path must share a string prefix with the intended destination directory name to bypass the commonprefix() check.
2. Host or distribute the tarball: Publish the malicious package to an untrusted package source, a compromised git repository, or a custom URL that a dbt user might reference in their packages.yml.
3. Induce the victim to install the package: Social-engineer or otherwise cause a dbt user running a vulnerable version of dbt-common (< 1.34.2 or 1.35.0–1.37.2) to run dbt deps, which triggers tarball extraction via safe_extract().
4. File written to sibling directory: The malicious tarball entry bypasses the commonprefix() validation and writes the attacker-controlled file to a sibling directory (e.g., /tmp/packagesevil/malicious.py) outside the intended extraction path.
5. Achieve objective: Depending on the sibling directory contents and application behavior, the injected file could be loaded or executed by dbt or an adjacent process, potentially enabling code execution or persistent compromise (GitHub Advisory, GitHub Commit).

• File System: Unexpected files appearing in directories adjacent to (but not within) the configured dbt packages extraction directory, particularly in directories whose names share a prefix with the extraction target (e.g., packages_evil/ alongside packages/); newly created .py, .sql, or script files in sibling directories not created by normal dbt operations.
• Logs: dbt execution logs showing package installation from untrusted or unrecognized URLs; absence of tarfile.OutsideDestinationError exceptions in environments running patched Python 3.12+ tarfile filters where such errors would normally be raised.
• Process: Unexpected processes spawned from the dbt Python environment after a dbt deps run; file integrity monitoring alerts on directories adjacent to the dbt packages directory.

Upgrade dbt-common to version 1.34.2 (for versions prior to 1.34.2) or 1.37.3 (for versions 1.35.0–1.37.2); these patched versions were released on March 13, 2026. The fix also propagates to dbt-core versions 1.11.7 and 1.10.20. As a workaround prior to patching, restrict dbt package sources exclusively to trusted origins such as the official dbt Hub or verified git repositories, and avoid installing packages from untrusted URLs. Additionally, implement file integrity monitoring on directories where dbt extracts archives to detect unauthorized file writes (GitHub Advisory, GitHub Commit).

The vulnerability was reported by security researcher sethmlarson, who identified the same class of flaw in pip (CVE-2026-1703) and subsequently flagged the analogous issue in dbt-common. The dbt-labs team acknowledged and remediated the issue promptly, publishing the fix within days of the report (GitHub Advisory). Community coverage has been limited, consistent with the low severity and absence of active exploitation.