Vulnary
← back to the feed
Critical· 9.3official fix available

CVE-2026-39382

A command injection vulnerability exists in the dbt-labs/actions workflow where an attacker-controlled comment body is inserted unsanitized into a bash script, allowing execution of arbitrary shell commands. The flaw is rated critical with a CVSS base score of 9.3. It is fixed by commit bbed8d28354e9c644c5a7df13946a3a0451f9ab9.

publishedApr 7, 2026
last modifiedJul 24, 2026
sourcesNVD
severity · cvss
9.3
critical · how bad it is
exploitation · epss
<1%
32th percentile · chance of exploitation in 30 days
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →
auto-deletes from the system
counting…on Aug 25, 2026

An official fix is available, so this entry is kept for 30 days and then removed automatically.

01

Who is affected

Users of the dbt-labs/actions repository who rely on the open-issue-in-repo.yml workflow.

02

Real-world impact

An attacker could post a malicious comment on a repository to execute arbitrary commands on the runner, potentially leading to full compromise of the build environment.

03

Why this severity

The vulnerability allows unauthenticated remote code execution with high impact on confidentiality, integrity, and availability, resulting in a critical CVSS score.

04

What to do about it

official fix available
recommended steps
  1. 011. Update the dbt-labs/actions repository to a version that includes commit bbed8d28354e9c644c5a7df13946a3a0451f9ab9 (e.g., by pulling the latest main branch or a tagged release that contains this commit).
  2. 022. If an immediate upgrade is not possible, manually apply the fix by cherry-picking commit bbed8d28354e9c644c5a7df13946a3a0451f9ab9 into your current branch.

NVD description (fix commit)

05

Timeline

  1. Apr 7, 2026 · Apr 7, 2026
    Published
    Disclosed and added to the National Vulnerability Database.
  2. Jul 24, 2026 · 11d ago
    Advisory updated
    The NVD record was last revised.
  3. Jul 26, 2026 · 10d ago
    Official fix available
    A vendor patch or mitigation now exists — see the remediation steps above.
06

How it’s attacked

Attack vectorNetwork (remote)
Attack complexityLow
Attack requirementsNone
Privileges requiredNone
User interactionNone needed
Confidentiality impactHigh
Integrity impactHigh
Availability impactHigh
07

References & advisories

(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →