{"id":"GHSA-j4g3-3q8x-jxqp","aliases":[],"status":"published","title":"dbt-core's secret env vars written to package-lock.json in plaintext","description":"### Impact\n\nWhen used to pull source code from a private repository using a Personal Access Token (PAT), some versions of dbt-core write a URL with the PAT in plaintext to the `package-lock.yml` file.\n\n### Patches\n\nThe bug has been fixed in [dbt-core v1.7.3](https://github.com/dbt-labs/dbt-core/releases/tag/v1.7.3).\n\n### Mitigations\n\nRemove any git URLs with plaintext secrets from `package-lock.yml` file(s) on servers, workstations, or in source control. Rotate any tokens that have been written to version-controlled files.","severity":{"version":"3.1","score":3.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N","level":"low","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-315"],"published":"2023-12-08T15:38:37Z","modified":"2026-02-27T15:54:39Z","fixes":[{"ecosystem":"PyPI","package":"dbt-core","fixed_in":["1.7.3"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"dbt-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.0"},{"fixed":"1.7.3"}]}]},{"source":"osv","ecosystem":"PyPI","package":"dbt-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.0"},{"fixed":"1.7.3"}]}],"versions":["1.7.0","1.7.1","1.7.2"]}],"references":[{"url":"https://github.com/dbt-labs/dbt-core/security/advisories/GHSA-j4g3-3q8x-jxqp","tags":["web"]},{"url":"https://github.com/dbt-labs/dbt-core/commit/09f5bb3dcffeda7a60ad2b22c2891f237628ecd1","tags":["web"]},{"url":"https://github.com/dbt-labs/dbt-core/releases/tag/v1.7.3","tags":["web"]},{"url":"https://github.com/advisories/GHSA-j4g3-3q8x-jxqp"},{"url":"https://github.com/dbt-labs/dbt-core","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-j4g3-3q8x-jxqp","title":"dbt-core's secret env vars written to package-lock.json in plaintext","description":"### Impact\n\nWhen used to pull source code from a private repository using a Personal Access Token (PAT), some versions of dbt-core write a URL with the PAT in plaintext to the `package-lock.yml` file.\n\n### Patches\n\nThe bug has been fixed in [dbt-core v1.7.3](https://github.com/dbt-labs/dbt-core/releases/tag/v1.7.3).\n\n### Mitigations\n\nRemove any git URLs with plaintext secrets from `package-lock.yml` file(s) on servers, workstations, or in source control. Rotate any tokens that have been written to version-controlled files.","status":"published","published":"2023-12-08T15:38:37Z","modified":"2026-02-27T15:54:39Z","cvss":[{"version":"3.1","score":3.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-315"],"updated_at":"2026-11-02T14:39:27.949248Z"}],"osv":[{"id":"GHSA-j4g3-3q8x-jxqp","title":"dbt-core's secret env vars written to package-lock.json in plaintext","description":"### Impact\n\nWhen used to pull source code from a private repository using a Personal Access Token (PAT), some versions of dbt-core write a URL with the PAT in plaintext to the `package-lock.yml` file.\n\n### Patches\n\nThe bug has been fixed in [dbt-core v1.7.3](https://github.com/dbt-labs/dbt-core/releases/tag/v1.7.3).\n\n### Mitigations\n\nRemove any git URLs with plaintext secrets from `package-lock.yml` file(s) on servers, workstations, or in source control. Rotate any tokens that have been written to version-controlled files.","status":"published","published":"2023-12-08T15:38:37Z","modified":"2024-12-04T05:42:25.774437Z","cvss":[{"version":"3.1","score":3.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-315"],"updated_at":"2026-11-02T15:46:49.977351Z"}]}}