GHSA-j4g3-3q8x-jxqp dbt-core's secret env vars written to package-lock.json in plaintext
dbt-core leaks Personal Access Tokens in plaintext within package-lock.yml when pulling from private repositories, exposing credentials to anyone with file access.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Not stated
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-j4g3-3q8x-jxqp?
GHSA-j4g3-3q8x-jxqp is a vulnerability in dbt-core, published on 8 Dec 2023.
Official description
Impact
When used to pull source code from a private repository using a Personal Access Token (PAT), some versions of dbt-core write a URL with the PAT in plaintext to the package-lock.yml file.
Patches
The bug has been fixed in dbt-core v1.7.3.
Mitigations
Remove any git URLs with plaintext secrets from package-lock.yml file(s) on servers, workstations, or in source control. Rotate any tokens that have been written to version-controlled files.
Which versions are affected by GHSA-j4g3-3q8x-jxqp?
2 open source packages ship an affected version, including dbt-core.
| Package | Affected | Fixed in |
|---|---|---|
dbt-core PyPI | From 1.7.0 | 1.7.3 |
dbt-core PyPI | From 1.7.0 | 1.7.3 |
How do I fix GHSA-j4g3-3q8x-jxqp?
Upgrade dbt-core to 1.7.3 or later.
Is GHSA-j4g3-3q8x-jxqp being exploited?
There is no known exploitation of GHSA-j4g3-3q8x-jxqp in the wild and no public exploit code.