The vulnerability stems from the dbt‑mcp server concatenating the values of the node_selection and resource_type parameters directly into the argument list used to invoke dbt through subprocess.Popen. Because these values are not sanitized, an MCP client can supply arbitrary dbt global flags—such as --profiles-dir, --project‑dir, and --target—that will be applied to the dbt command, even though shell=False is used, which mitigates traditional shell metacharacter injection. The attacker can therefore alter the execution context of dbt commands, misconfiguring or redirecting dbt runs. This does not enable arbitrary shell execution; the impact is limited to the configuration of dbt runs. The issue was addressed in version 1.17.1.

The affected product is dbt-labs dbt-mcp, any release prior to v1.17.1. Releases from v1.17.1 onward include the fix that sanitizes the node_selection and resource_type inputs.

The CVSS score of 6.3 indicates moderate severity. The EPSS score of less than 1% suggests exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog. The attack vector would require an attacker to connect to the MCP server as a client and supply crafted node_selection or resource_type values; therefore the risk is higher in environments where the MCP interface is exposed to untrusted users or networks. Successful exploitation would enable an attacker to influence the execution context of dbt commands, but it does not directly lead to arbitrary code execution.