p PatchFirst

CVE-2026-44968

CVE-2026-44968 · dbt-mcp: Argument Injection in dbt CLI Tool Wrappers via node_selection and resource_type Parameters

This page contains facts from public vulnerability sources. Check the original advisory before updating.

dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.17.1, _run_dbt_command() in src/dbt_mcp/dbt_cli/tools.py appended unsanitized node_selection and resource_type values to the dbt subprocess argument list, allowing an MCP client to inject dbt global flags such as --profiles-dir, --project-dir, and --target into subprocess.Popen even though shell=False prevents shell metacharacter injection. This issue is fixed in version 1.17.1.

CVSS 6.3 · Medium · EPSS 0.2% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • dbt-mcp

    Versions
    • < 1.17.1: Affected

    No fix published

  • dbt-mcp PyPI

    Versions
    • 0.0.1a1
    • 0.1.0
    • 0.1.1
    • 0.1.2
    • 0.1.2rc1
    • 0.1.2rc2
    • 0.1.3
    • 0.10.0
    • 0.10.1
    • 0.10.2
    • 0.10.3
    • 0.2.1
    • 0.2.10
    • 0.2.11
    • 0.2.12
    • 0.2.13
    • 0.2.14
    • 0.2.15
    • 0.2.16
    • 0.2.17
    • 0.2.18
    • 0.2.19
    • 0.2.20
    • 0.2.3
    • 0.2.4
    • 0.2.5
    • 0.2.6
    • 0.2.7
    • 0.2.8
    • 0.2.9
    • 0.3.0
    • 0.4.0
    • 0.4.1
    • 0.4.2
    • 0.5.0
    • 0.6.0
    • 0.6.1
    • 0.7.0
    • 0.8.0
    • 0.8.1
    • 0.8.2
    • 0.8.3
    • 0.8.4
    • 0.9.0
    • 0.9.1
    • 1.0.0
    • 1.1.0
    • 1.10.0
    • 1.11.0
    • 1.12.0
    • 1.13.0
    • 1.14.0
    • 1.15.0
    • 1.17.0
    • 1.2.0
    • 1.3.0
    • 1.4.0
    • 1.5.0
    • 1.5.1
    • 1.5.2
    • 1.6.0
    • 1.6.2
    • 1.7.0
    • 1.8.0
    • 1.8.1
    • 1.9.0
    • 1.9.1
    • 1.9.2
    • 1.9.3
    Affected ranges
    • ECOSYSTEM: < 1.17.1

    Update to 1.17.1

Original sources

Check your server →