NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
🐍
🐍 PyPI
Not in CISA KEV
HIGH severity

dbt uses a SQLparse version with a high vulnerabilityGHSA-p72q-h37j-3hq7

HIGH

GHSA-p72q-h37j-3hq7 is a high-severity (CVSS 7.5) vulnerability in dbt-core. A fix is available for dbt-core — see the affected versions and patch details below.

Published
Updated
Affected
2 pkgs
Patched
2 / 2
Exploits
None indexed
Exploitation data as of Dec 5, 2024 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

2 pkgs affected
🐍dbt-core🐍dbt-core

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects PyPI packages — download data is not available via public APIs for these ecosystems.

Description

Summary

Using a version of sqlparse that has a security vulnerability and no way to update in current version of dbt core. Snyk recommends using sqlparse==0.5 but this causes a conflict with dbt. Snyk states the issues is a recursion error: SNYK-PYTHON-SQLPARSE-6615674.

Details

Dependency conflict error message:

The conflict is caused by:
    The user requested sqlparse==0.5
    dbt-core 1.7.10 depends on sqlparse<0.5 and >=0.2.3

Resolution was to pin sqlparse >=0.5.0, <0.6.0 in dbt-core, patched in 1.6.13 and 1.7.13.

PoC

From Snyk:

import sqlparse
sqlparse.parse('[' * 10000 + ']' * 10000)

Impact

Snyk classifies it as high 7.5/10.

Patches

The bug has been fixed in dbt-core v1.6.13 and dbt-core v1.7.13.

Mitigations

Bump dbt-core 1.6 and 1.7 dependencies to 1.6.13 and 1.7.13 respectively

Affected Packages

2 total 2 fixed
EcosystemPackageVulnerable rangeFix
🐍PyPIdbt-core≥ 1.6.0&&< 1.6.131.6.13pip install --upgrade 'dbt-core==1.6.13'
🐍PyPIdbt-core≥ 1.7.0&&< 1.7.131.7.13pip install --upgrade 'dbt-core==1.7.13'

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for dbt-core, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update dbt-core to 1.6.13 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-p72q-h37j-3hq7 is resolved across your whole dependency graph.

  3. Workarounds

    If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

Frequently Asked Questions

### Summary Using a version of `sqlparse` that has a security vulnerability and no way to update in current version of dbt core. Snyk recommends using `sqlparse==0.5` but this causes a conflict with dbt. Snyk states the issues is a recursion error: `SNYK-PYTHON-SQLPARSE-6615674`. ### Details Dependency conflict error message: ```sh The conflict is caused by: The user requested sqlparse==0.5 dbt-core 1.7.10 depends on sqlparse<0.5 and >=0.2.3 ``` Resolution was to pin `sqlparse >=0.5.0, <0.6.0` in `dbt-core`, patched in 1.6.13 and 1.7.13. ### PoC From Snyk: ```python import sqlparse
O3 Security · Impact-Aware SCA

Is GHSA-p72q-h37j-3hq7 in your dependencies?

Find it across PyPI, including transitive dependencies.

Scan my dependencies How O3 SCA works
dbt uses a SQLparse version with a high vulnerability