CVE-2026-39382 dbt-labs CVE debrief

Who should care

Users of dbt, particularly those who use the reusable workflow dbt-labs/actions/blob/main/.github/workflows/open-issue-in-repo.yml, should be aware of this vulnerability and take steps to mitigate it. Affected operators, platform administrators, vulnerability management teams, and security teams should review the vulnerability and take necessary actions to protect their systems.

Technical summary

The vulnerability exists in the reusable workflow dbt-labs/actions/blob/main/.github/workflows/open-issue-in-repo.yml, where the prep job uses peter-evans/find-comment to search for an existing comment indicating that a docs issue has already been opened. The output steps.issue_comment.outputs.comment-body is then interpolated directly into a bash if statement without escaping, allowing an attacker to inject arbitrary shell commands. This vulnerability is fixed with commit bbed8d28354e9c644c5a7df13946a3a0451f9ab9.

Defensive priority

High

Recommended defensive actions

• Apply the patch from commit bbed8d28354e9c644c5a7df13946a3a0451f9ab9
• Use secure practices when interpolating user-controlled data into shell commands
• Monitor for suspicious activity in dbt workflows
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record was published on 2026-04-07T20:16:32.980Z and has not been modified since then. The NVD entry is currently Deferred. There is limited information available about the vulnerability, and defenders should verify the affected scope and severity with the vendor. The vulnerability exists in the reusable workflow dbt-labs/actions/blob/main/.github/workflows/open-issue-in-repo.yml, where the prep job uses peter-evans/find-comment to search for an existing comment indicating that a docs issue has already been opened.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.