-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| dbt-core | pip | >= 1.6.0, < 1.6.14 | 1.6.14 |
| dbt-core | pip | >= 1.7.0, < 1.7.14 | 1.7.14 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from how dbt resolves materialization macros. The find_materialization_macro_by_name function's logic in manifest.py was modified in the patch to add security checks. Pre-patch behavior: 1) It sorted macro candidates by specificity 2) Returned the last candidate (highest precedence) 3) Allowed package macros to override core materializations by default. The commit diff shows critical changes to this function including deprecation warnings and flag checks (require_explicit_package_overrides_for_builtin_materializations), confirming this was the injection point for unauthorized overrides.