CVE-2026-29790 | dbt-labs dbt-common up to 1.34.1/1.37.2 tarball os.path.commonprefix path traversal

A vulnerability classified as critical was found in dbt-labs dbt-common up to 1.34.1/1.37.2. This affects the function os.path.commonprefix of the component tarball Handler. The manipulation results in path traversal.

This vulnerability is identified as CVE-2026-29790. The attack can be executed remotely. There is not any exploit available.

Upgrading the affected component is advised.