diff --git a/requirements.txt b/requirements.txt
index 2889a0e2..f89bc147 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -37,7 +37,7 @@ tables
 tree-sitter-python
 tree-sitter
 
-python-dotenv
+python-dotenv>=1.2.2  # CVE: symlink following allows arbitrary file overwrite
 
 # infrastructure related.
 docker