CVE-2026-44968

Name of the Vulnerable Software and Affected Versions dbt-mcp version 1.15.1

Description The run dbt command() function in src/dbt mcp/dbt cli/tools.py is susceptible to argument list injection. This occurs because user-supplied parameters are appended to the dbt subprocess argument list without proper sanitization, allowing an attacker to inject arbitrary dbt global flags. There are two primary injection vectors: the node selection string and the resource type JSON array. By exploiting these, an attacker can use flags such as --profiles-dir, --project-dir, and --target to override the server's configuration, redirect the project root, or change the execution environment. For instance, injecting a malicious --profiles-dir allows dbt to load an attacker-controlled profiles.yml file, potentially leading to unauthorized database operations.

Recommendations For version 1.15.1, implement validation for the node selection parameter by ensuring each token matches a safe regex pattern and does not begin with a hyphen. For version 1.15.1, validate the resource type parameter against an explicit allowlist of recognized resource types. As a temporary mitigation, restrict the use of the node selection and resource type parameters to trusted inputs only.