GHSA-p72q-h37j-3hq7
dbt uses a SQLparse version with a high vulnerability
GHSA-p72q-h37j-3hq7 is a high vulnerability (CVSS 7.5) in dbt-core, published April 22, 2024. No source lists public exploit code. Fixed in dbt-core 1.6.13.
- Severity
- 7.5 HighCVSS 3.1, GitHub Advisories
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
1.6.13dbt-core +3 more
Description
Summary
Using a version of sqlparse that has a security vulnerability and no way to update in current version of dbt core. Snyk recommends using sqlparse==0.5 but this causes a conflict with dbt. Snyk states the issues is a recursion error: SNYK-PYTHON-SQLPARSE-6615674.
Details
Dependency conflict error message:
The conflict is caused by:
The user requested sqlparse==0.5
dbt-core 1.7.10 depends on sqlparse<0.5 and >=0.2.3
Resolution was to pin sqlparse >=0.5.0, <0.6.0 in dbt-core, patched in 1.6.13 and 1.7.13.
PoC
From Snyk:
import sqlparse
sqlparse.parse('[' * 10000 + ']' * 10000)
Impact
Snyk classifies it as high 7.5/10.
Patches
The bug has been fixed in dbt-core v1.6.13 and dbt-core v1.7.13.
Mitigations
Bump dbt-core 1.6 and 1.7 dependencies to 1.6.13 and 1.7.13 respectively
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Affected packages
| Package | Affected | Fixed |
|---|---|---|
dbt-corePyPI | 1.6.0 up to 1.6.13 | 1.6.13 |
dbt-corePyPI | 1.7.0 up to 1.7.13 | 1.7.13 |
dbt-corePyPI | 1.6.0 up to 1.6.13, plus listed versions 1.6.11.6.101.6.111.6.121.6.1rc1 Show 8 moreShow less1.6.21.6.31.6.41.6.51.6.61.6.71.6.81.6.9 | 1.6.13 |
dbt-corePyPI | 1.7.0 up to 1.7.13, plus listed versions 1.7.11.7.101.7.111.7.121.7.2 Show 7 moreShow less1.7.31.7.41.7.51.7.61.7.71.7.81.7.9 | 1.7.13 |
What each source reports
GitHub Advisories Score used
dbt uses a SQLparse version with a high vulnerability
Summary
Using a version of sqlparse that has a security vulnerability and no way to update in current version of dbt core. Snyk recommends using sqlparse==0.5 but this causes a conflict with dbt. Snyk states the issues is a recursion error: SNYK-PYTHON-SQLPARSE-6615674.
Details
Dependency conflict error message:
The conflict is caused by:
The user requested sqlparse==0.5
dbt-core 1.7.10 depends on sqlparse<0.5 and >=0.2.3
Resolution was to pin sqlparse >=0.5.0, <0.6.0 in dbt-core, patched in 1.6.13 and 1.7.13.
PoC
From Snyk:
import sqlparse
sqlparse.parse('[' * 10000 + ']' * 10000)
Impact
Snyk classifies it as high 7.5/10.
Patches
The bug has been fixed in dbt-core v1.6.13 and dbt-core v1.7.13.
Mitigations
Bump dbt-core 1.6 and 1.7 dependencies to 1.6.13 and 1.7.13 respectively
- Record
GHSA-p72q-h37j-3hq7- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-673
- Updated
- 2026-11-02
OSV
dbt uses a SQLparse version with a high vulnerability
Summary
Using a version of sqlparse that has a security vulnerability and no way to update in current version of dbt core. Snyk recommends using sqlparse==0.5 but this causes a conflict with dbt. Snyk states the issues is a recursion error: SNYK-PYTHON-SQLPARSE-6615674.
Details
Dependency conflict error message:
The conflict is caused by:
The user requested sqlparse==0.5
dbt-core 1.7.10 depends on sqlparse<0.5 and >=0.2.3
Resolution was to pin sqlparse >=0.5.0, <0.6.0 in dbt-core, patched in 1.6.13 and 1.7.13.
PoC
From Snyk:
import sqlparse
sqlparse.parse('[' * 10000 + ']' * 10000)
Impact
Snyk classifies it as high 7.5/10.
Patches
The bug has been fixed in dbt-core v1.6.13 and dbt-core v1.7.13.
Mitigations
Bump dbt-core 1.6 and 1.7 dependencies to 1.6.13 and 1.7.13 respectively
- Record
GHSA-p72q-h37j-3hq7- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-673
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.