CVE-2026-39382: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in dbt-labs dbt-core
CVE-2026-39382 is a critical OS command injection vulnerability in dbt-labs dbt-core. It arises from unsafe interpolation of attacker-controlled comment text into a bash if statement within a GitHub Actions workflow. This allows an attacker to inject arbitrary shell commands. The vulnerability affects versions prior to commit bbed8d28354e9c644c5a7df13946a3a0451f9ab9. A fix has been implemented in that commit. The CVSS 4. 0 score is 9. 3, indicating critical severity with network attack vector and no required privileges or user interaction.
AI Analysis
Technical Summary
The vulnerability exists in the GitHub Actions workflow file open-issue-in-repo.yml used by dbt-labs dbt-core. The prep job uses the peter-evans/find-comment action to retrieve an existing comment's body, which is then directly interpolated into a bash if statement without proper escaping. Because the comment body is attacker-controlled, this allows breaking out of the quoted string and injecting arbitrary shell commands, leading to OS command injection (CWE-78). This issue affects all versions prior to commit bbed8d28354e9c644c5a7df13946a3a0451f9ab9, which contains the fix.
Potential Impact
Successful exploitation allows an unauthenticated attacker to execute arbitrary shell commands on the system running the vulnerable GitHub Actions workflow. This can lead to full compromise of the workflow environment, potentially affecting CI/CD pipelines and related infrastructure. The CVSS 4.0 score of 9.3 reflects high impact on confidentiality, integrity, and availability with no required privileges or user interaction.
Mitigation Recommendations
A fix is available and has been implemented in commit bbed8d28354e9c644c5a7df13946a3a0451f9ab9. Users should upgrade to this commit or later versions of dbt-core to remediate the vulnerability. There is no vendor advisory content contradicting this; thus, applying the official fix is the recommended mitigation.
CVE-2026-39382: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in dbt-labs dbt-core
Description
CVE-2026-39382 is a critical OS command injection vulnerability in dbt-labs dbt-core. It arises from unsafe interpolation of attacker-controlled comment text into a bash if statement within a GitHub Actions workflow. This allows an attacker to inject arbitrary shell commands. The vulnerability affects versions prior to commit bbed8d28354e9c644c5a7df13946a3a0451f9ab9. A fix has been implemented in that commit. The CVSS 4. 0 score is 9. 3, indicating critical severity with network attack vector and no required privileges or user interaction.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability exists in the GitHub Actions workflow file open-issue-in-repo.yml used by dbt-labs dbt-core. The prep job uses the peter-evans/find-comment action to retrieve an existing comment's body, which is then directly interpolated into a bash if statement without proper escaping. Because the comment body is attacker-controlled, this allows breaking out of the quoted string and injecting arbitrary shell commands, leading to OS command injection (CWE-78). This issue affects all versions prior to commit bbed8d28354e9c644c5a7df13946a3a0451f9ab9, which contains the fix.
Potential Impact
Successful exploitation allows an unauthenticated attacker to execute arbitrary shell commands on the system running the vulnerable GitHub Actions workflow. This can lead to full compromise of the workflow environment, potentially affecting CI/CD pipelines and related infrastructure. The CVSS 4.0 score of 9.3 reflects high impact on confidentiality, integrity, and availability with no required privileges or user interaction.
Mitigation Recommendations
A fix is available and has been implemented in commit bbed8d28354e9c644c5a7df13946a3a0451f9ab9. Users should upgrade to this commit or later versions of dbt-core to remediate the vulnerability. There is no vendor advisory content contradicting this; thus, applying the official fix is the recommended mitigation.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-04-06T22:06:40.515Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69d5660baaed68159a5b4076
Added to database: 4/7/2026, 8:16:11 PM
Last enriched: 4/15/2026, 3:53:07 PM
Last updated: 5/22/2026, 11:48:54 PM
Views: 155
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.