d
dbt labs
Security Risk Profile
63
/100
highSecurity Risk Score
Comprehensive risk assessment based on 26 vulnerabilities, EPSS scores, exploitation status, and remediation availability.
📅 Data spans from December 3, 2021 to present
26
Total CVEs
1
Critical+High
0
Exploited
1
Unpatched
Threat Assessment
Avg CVSS
9.3
Base severity
Avg EPSS
0%
Exploit probability
Unpatched
1
Critical/High
Risk Level
63/100
high
🆕 1Fresh (<7d)📈 1 in Last 30 Days
Severity Distribution
Critical
1High
0Medium
0Low
0Exploit Likelihood
>50% chance
020-50%
05-20%
0<5%
0Age Distribution
Common Weaknesses (CWE)
1
Path Traversal
1
2
Infoleak
1
3
OS Command Injection
1
Most Affected Products
1. dbt Labs dbt Core24
2. dbt Labs dbt1
3. dbt Labs dbt-labs/actions1
Recent Vulnerabilities
See more →CVE-2026-100406
unknown
dbt: Unauthenticated Arbitrary SQL Execution in `dbt docs serve`
Oct 14, 2026🔧 No Patch
EOL-dbt-core-2.0
unknown
Sep 14, 2026
EOL-dbt-core-1.12
unknown
Jul 16, 2026
CVE-2026-39382
CVSS 9.3critical
dbt has a Command Injection in Reusable Workflow via Unsanitized comment-body Output
Apr 7, 2026🔧 No Patch
EOL-dbt-core-1.11
unknown
Dec 19, 2025
EOL-dbt-core-1.10
unknown
Jun 16, 2025
latest-version-dbt-core-1.9
unknown
Dec 9, 2024
EOL-dbt-core-1.9
unknown
Dec 9, 2024
EOL-dbt-core-1.7
unknown
Dec 2, 2024
latest-version-dbt-core-1.7
unknown
Dec 2, 2024
Monitor dbt labs in Real-Time
Get instant alerts when new vulnerabilities are discovered. Stay ahead of security threats with SecAlerts.