Most recent entries from all

EUVD-2026-338575

fkie_cve-2026-44968

dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.17.1, _run_dbt_command() in src/dbt_mcp/dbt_cli/tools.py appended unsanitized node_selection and resource_type values to the dbt subprocess argument list, allowing an MCP client to inject dbt global flags such as --profiles-dir, --project-dir, and --target into subprocess.Popen even though shell=False prevents shell metacharacter injection. This issue is fixed in version 1.17.1.

GHSA-xpww-f6pm-cfhq — dbt MCP Server has an Argument Injection in dbt CLI Tool Wrappers via node_selection and resource_type Parameters

Affected: PyPI: dbt-mcp

*Discovered through manual source code review. Verified by PoC execution against a local dbt-mcp v1.15.1 installation.**

## Summary

`_run_dbt_command()` in `src/dbt_mcp/dbt_cli/tools.py` constructs the dbt subprocess argument list by appending user-supplied MCP tool parameters without sanitization. Two independent injection vectors exist. An MCP client can inject arbitrary dbt global flags — such as `--profiles-dir`, `--project-dir`, and `--target` — by crafting the `node_selection` string (Vector 1) or the `resource_type` JSON array (Vector 2). Because `subprocess.Popen` is called with `shell=False` and a list argument, shell metacharacter injection is not possible; however, this provides no defense against argument list injection (CWE-88), where attacker-controlled tokens are interpreted by the target process as flags rather than values.

## Details

**Vector 1 — `node_selection` string** Affected tools: `build`, `compile`, `run`, `test`, `clone`, `list`, `get_node_details_dev`

```python # src/dbt_mcp/dbt_cli/tools.py lines 77–79 if node_selection and isinstance(node_selection, str): selector_params = node_selection.split(" ") command.extend(["--select"] + selector_params) ```

`str.split(" ")` does not distinguish dbt selector tokens from flag tokens. Input `"my_model --profiles-dir /tmp/evil"` produces:

```` ["dbt", "--no-use-colors", "run", "--select", "my_model", "--profiles-dir", "/tmp/evil"] ````

dbt parses the injected `--profiles-dir` as a global opt…

PYSEC-2026-2444 — dbt MCP Server has an Argument Injection in dbt CLI Tool Wrappers via node_selection and resource_type Parameters