AIKIDO-2025-10921
dbt-databricks is vulnerable to Improper Input Validation
20
Low Risk
This Affects:
dbt-databricksTL;DR
Affected versions of this package have improper input validation. Query tag values were not validated. Special characters like backslashes, commas, and colons remained unescaped. Values longer than 128 characters could be processed without truncation, resulting in invalid query tags. An attacker could inject crafted query tag values using these characters to manipulate query parsing. It might lead to data corruption, security breaches, or system errors.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
dbt-databricks is vulnerable to Improper Input Validation in versions 1.0.0 - 1.11.2.
How to fix this
Upgrade the dbt-databricks library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant