dbt-mcp node_selection/resource_type Argument Injection (CVE-2026-44968) - ATR-2026-01982 (82d33eea-78db-5ed6-8f61-1fb0c6246558)
Detects CVE-2026-44968 / GHSA-xpww-f6pm-cfhq (CWE-88): dbt-mcp's _run_dbt_command() in src/dbt_mcp/dbt_cli/tools.py appends the MCP-client-supplied node_selection string (split on space) and resource_type JSON array verbatim to the dbt subprocess argv without validating that tokens don't begin with a dash. Because Popen is called with shell=False, shell metacharacters are inert, but an attacker can still inject dbt global flags — --profiles-dir, --project-dir, --target, --profile — as independent argv elements on the build/compile/run/test/ clone/list/get_node_details_dev tools, redirecting dbt's configuration, project root, or execution target (demonstrated PoC: node_selection = "my_model --profiles-dir /tmp/evil" loads an attacker-controlled profiles.yml and writes to an attacker-chosen database path). Detection covers: (a) a node_selection value containing an injected dbt global flag token after the legitimate selector (space-separated, so the flag rides along as an extra "word"); (b) a resource_type JSON array containing an injected flag token as an array element instead of a valid resource type; (c) explicit CVE-2026-44968 / GHSA-xpww-f6pm-cfhq exploitation framing. The detection target is the request shape — a dash-prefixed dbt global flag riding inside a selector/resource-type value that should only ever contain a selector or resource-type token — which is the exact argument- injection primitive, caught before _run_dbt_command() extends argv. Bound to the dbt-mcp tool surface (node_selection/resource_type params) so a benign selector string elsewhere does not fire.