Threats tagged 'ghsa-mjw2-v2hm-wj34'

Dagster's DuckDB, Snowflake, BigQuery, and DeltaLake I/O managers are vulnerable to SQL injection via dynamic partition keys. Users with the 'Add Dynamic Partitions' permission can inject arbitrary SQL that executes with the I/O manager's database credentials. This affects deployments using dynamic partitions; static or time-window partitions are not impacted. The vulnerability is most relevant where this permission is granted independently of broader database access. A fix is available in Dagster versions 0.29.1 and 1.13.1.