dbt has an implicit override for built-in materializations from installed packages
Impact
What kind of vulnerability is it? Who is impacted?
When a user installs a package in dbt, it has the ability to override macros, materializations, and other core components of dbt. This is by design, as it allows packages to extend and customize dbt's functionality. However, this also means that a malicious package could potentially override these components with harmful code.
Patches
Has the problem been patched? What versions should users upgrade to?
Fixed on 1.8.0, and patched for 1.6.14 and 1.7.14 releases.
Workarounds
Is there a way for users to fix or remediate the vulnerability without upgrading?
Previously, a materialization defined in a package that shared a name with one of the built-in materializations would be preferred by default, without user action which is surprising and makes it more difficult to detect the insecure behaviour. We've changed the default behaviour to require explicit overrides by users in 1.8.0, and provided the ability to opt-out of built-in materialization overrides in 1.6 and 1.7 via the flags.require_explicit_package_overrides_for_builtin_materializations: False configuration in dbt_project.yml
Versions older than 1.6 are EOL.
References
Are there any links users can visit to find out more?
- dbt documentation: https://docs.getdbt.com/reference/global-configs/legacy-behaviors#behavior-change-flags
- https://www.elementary-data.com/post/are-dbt-packages-secure-the-answer-lies-in-your-dwh-policies
- https://www.equalexperts.com/blog/tech-focus/are-you-at-risk-from-this-critical-dbt-vulnerability/
- https://tempered.works/posts/2024/07/06/preventing-data-theft-with-gcp-service-controls/
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Python (PyPI) | dbt-core | >= 1.6.0, < 1.6.14, >= 1.7.0, < 1.7.14 | 1.6.14, 1.7.14 |
References
- https://github.com/dbt-labs/dbt-core/security/advisories/GHSA-p3f3-5ccg-83xq
- https://github.com/dbt-labs/dbt-core/commit/3c82a0296d227cb1be295356df314c11716f4ff6
- https://github.com/dbt-labs/dbt-core/commit/87ac4deb00cc9fe334706e42a365903a1d581624
- https://docs.getdbt.com/docs/build/packages
- https://docs.getdbt.com/reference/global-configs/legacy-behaviors#behavior-change-flags
- https://tempered.works/posts/2024/07/06/preventing-data-theft-with-gcp-service-controls
- https://www.elementary-data.com/post/are-dbt-packages-secure-the-answer-lies-in-your-dwh-policies
- https://www.equalexperts.com/blog/tech-focus/are-you-at-risk-from-this-critical-dbt-vulnerability
- https://nvd.nist.gov/vuln/detail/CVE-2024-40637
- https://github.com/dbt-labs/dbt-core
- https://github.com/pypa/advisory-database/tree/main/vulns/dbt-core/PYSEC-2024-66.yaml
- CVSS vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L- Weakness (CWE)
CWE-74, CWE-89, CWE-913- Platform
- Python (PyPI)
- Package
dbt-core- Disclosed
- 16.07.2024
- Updated
- 11.10.2026 15:17
Sources and licenses
OSV / GitHub Advisory Database - PYSEC-2024-66 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-p3f3-5ccg-83xq - CC BY 4.0
Vulnerability history: dbt-core
All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 4
- First → latest
- 12.2023 07.2024
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 1
- Medium 1
- Low 2
Disclosures per year
- 2023: 1
- 2024: 3
- 2025: 0
- 2026: 0
-
dbt has an implicit override for built-in materializations from installed packages this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.