PyPI: dbt-common
CVE-2026-29790
Safety vulnerability ID: SFTY-20260305-15357
Safety legacy ID: pyup.io-88432
Affected versions of the dbt-common package are vulnerable to Path Traversal due to improper path validation when extracting tarball archives. The safe_extract() function uses os.path.commonprefix() to verify that archive members remain under the intended extraction directory, but because commonprefix() compares paths character-by-character instead of by path components, a crafted tarball can cause files to be written to sibling directories with matching prefixes.
Overview
dbt-common's commonprefix() doesn't protect against path traversal
Advisory
Affected versions of the dbt-common package are vulnerable to Path Traversal due to improper path validation when extracting tarball archives. The safe_extract() function uses os.path.commonprefix() to verify that archive members remain under the intended extraction directory, but because commonprefix() compares paths character-by-character instead of by path components, a crafted tarball can cause files to be written to sibling directories with matching prefixes.
How to Fix
Mitigation and Workarounds
---
Vulnerable Functions
Functions linked to known vulnerabilities.
References
- https://getsafety.com/vulnerabilities/SFTY-20260305-15357/CVE-2026-29790
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-29790
- https://github.com/advisories/GHSA-w75w-9qv4-j5xj
- https://github.com/dbt-labs/dbt-common/commit/e547954a48bac9394ef6eb98432e429dce9a7709
- https://github.com/dbt-labs/dbt-common/security/advisories/GHSA-w75w-9qv4-j5xj
- https://github.com/pypa/pip/pull/13777
- https://github.com/dbt-labs/dbt-common/commit/e547954a48bac9394ef6eb98432e429dce9a7709
- https://docs.python.org/3/library/os.path.html#os.path.commonpath
- https://github.com/advisories/GHSA-6vgw-5pg2-w6jp
- https://nvd.nist.gov/vuln/detail/CVE-2026-29790
- https://github.com/advisories/GHSA-w75w-9qv4-j5xj
Verified by Safety
Our Cybersecurity Intelligence Team reviewed this vulnerability. We combine public data with our own research to find issues not yet reported to public sources.
Learn more