Is CVE-2026-29790 actively exploited?

No active exploitation of CVE-2026-29790 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-29790 be exploited remotely?

Yes. CVE-2026-29790 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-29790?

CVE-2026-29790 has a CVSS score of 5.3 (MEDIUM).

HOME VULNERABILITIESCVE-2026-29790

MEDIUM

CVE-2026-29790

CWE-22Published: March 6, 2026· Updated: Mar 13, 2026

5.3

CVSS v3.1

EPSS:0.04%probability of exploitation in 30 daysPercentile:13.0th

Official Description

dbt-common is the shared common utilities for dbt-core and adapter implementations use. Prior to versions 1.34.2 and 1.37.3, a path traversal vulnerability exists in dbt-common's safe_extract() function used when extracting tarball archives. The function uses os.path.commonprefix() to validate that extracted files remain within the intended destination directory. However, commonprefix() compares paths character-by-character rather than by path components, allowing a malicious tarball to write files to sibling directories with matching name prefixes. This issue has been patched in versions 1.34.2 and 1.37.3.

NVD Source

Technical Analysis

CVE-2026-29790 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.