dbt-mcp

The server directly invokes external dbt CLI commands (`subprocess.Popen` in `src/dbt_mcp/dbt_cli/tools.py` and `src/dbt_mcp/dbt_codegen/tools.py`) and passes arguments originating from LLM output (e.g., `selector`, `vars`, `sql_query`). There is no explicit sanitization or strict validation of these string arguments to prevent shell or SQL injection before they are passed to the underlying `dbt` binary. While arguments are generally passed as a list to `Popen` (safer than `shell=True`), a sophisticated LLM could craft inputs that exploit the way `dbt` or the shell interprets these arguments, leading to arbitrary command execution or data manipulation (especially via the `dbt show` tool which runs arbitrary SQL). This lack of robust input sanitization for external process execution represents a significant security risk when integrating with potentially untrusted or adversarial LLMs.