CVE-2026-39382
A command injection vulnerability exists in the dbt-labs/actions workflow where an attacker-controlled comment body is inserted unsanitized into a bash script, allowing execution of arbitrary shell commands. The flaw is rated critical with a CVSS base score of 9.3. It is fixed by commit bbed8d28354e9c644c5a7df13946a3a0451f9ab9.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Users of the dbt-labs/actions repository who rely on the open-issue-in-repo.yml workflow.
Real-world impact
An attacker could post a malicious comment on a repository to execute arbitrary commands on the runner, potentially leading to full compromise of the build environment.
Why this severity
The vulnerability allows unauthenticated remote code execution with high impact on confidentiality, integrity, and availability, resulting in a critical CVSS score.
What to do about it
- 011. Update the dbt-labs/actions repository to a version that includes commit bbed8d28354e9c644c5a7df13946a3a0451f9ab9 (e.g., by pulling the latest main branch or a tagged release that contains this commit).
- 022. If an immediate upgrade is not possible, manually apply the fix by cherry-picking commit bbed8d28354e9c644c5a7df13946a3a0451f9ab9 into your current branch.
NVD description (fix commit)
Timeline
- Apr 7, 2026 · Apr 7, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 24, 2026 · 11d agoAdvisory updatedThe NVD record was last revised.
- Jul 26, 2026 · 10d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.