dbt-labs/dbt-core · Security
dbt-core's secret env vars written to package-lock.json in plaintext
- GHSA ID
- GHSA-j4g3-3q8x-jxqp
- Severity
- low
- Published
- Updated
- CVSS
- 3.2 · CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N
- CVSS v3
- 3.2 · CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N
Description
Impact
When used to pull source code from a private repository using a Personal Access Token (PAT), some versions of dbt-core write a URL with the PAT in plaintext to the package-lock.yml file.
Patches
The bug has been fixed in dbt-core v1.7.3.
Mitigations
Remove any git URLs with plaintext secrets from package-lock.yml file(s) on servers, workstations, or in source control. Rotate any tokens that have been written to version-controlled files.
CWEs
- CWE-315 · Cleartext Storage of Sensitive Information in a Cookie