GHSA-x4ff-q6h8-v7gw

Source

https://github.com/advisories/GHSA-x4ff-q6h8-v7gw

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-x4ff-q6h8-v7gw/GHSA-x4ff-q6h8-v7gw.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-x4ff-q6h8-v7gw

Aliases

CVE-2026-32948

Published

2026-03-24T16:04:12Z

Modified

2026-03-27T22:05:00Z

Severity

6.7 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

sbt: Source dependency feature (via crafted VCS URL) leads to arbitrary code execution on Windows

Details

Summary

On Windows, sbt uses Process("cmd", "/c", ...) to run VCS commands (git, hg, svn). The URI fragment (branch, tag, revision) is user-controlled via the build definition and passed to these commands without validation. Because cmd /c interprets &, |, and ; as command separators, a malicious fragment can execute arbitrary commands.

Patched version

Technically, sbt 1.12.7 is patched, but it has a bug that makes source dependency non-functional, so update to sbt 1.12.8 or later instead.

Details

Resolvers.scala L84–95 — git resolver passes uri.getFragment() to run() without sanitization
Resolvers.scala L137–145 — run() uses Process("cmd", "/c", ...) on Windows, so cmd interprets && as command separator

PoC

# build.properties
# sbt.version=1.12.5  # Tested on those two versions of sbt
sbt.version=2.0.0-RC9

// build.sbt

ThisBuild / scalaVersion := "2.12.19"

lazy val root = project
  .in(file("."))
  .dependsOn(vulnerable)

lazy val vulnerable = RootProject(
  uri("https://github.com/sbt/io.git#develop%26%26calc.exe")
)

Impact

Windows users are impacted. An attacker can execute arbitrary Windows commands if they control the dependency URI.

Database specific

{
    "cwe_ids":  [
        "CWE-78"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-03-24T16:04:12Z",
    "nvd_published_at":  "2026-03-24T20:16:27Z",
    "severity":  "MODERATE"
}

References

Affected packages

Maven / org.scala-sbt:sbt

Package

Name: org.scala-sbt:sbt; View open source insights on deps.dev
Purl: pkg:maven/org.scala-sbt/sbt

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0.9.5

Fixed

1.12.8

Affected versions

0.*

0.99.2

0.99.4

1.*

1.0.0-M1

1.0.0-M2

1.0.0-M3

1.0.0-M4

1.0.0-M5

1.0.0-M6

1.0.0-RC1

1.0.0-RC2

1.0.0-RC3

1.0.0

1.0.1

1.0.2

1.0.3

1.0.4

1.1.0-M1

1.1.0-RC1

1.1.0-RC2

1.1.0-RC3

1.1.0-RC4

1.1.0

1.1.1

1.1.2

1.1.3

1.1.4

1.1.5

1.1.6

1.2.0-M1

1.2.0-RC1

1.2.0-RC2

1.2.0-RC3

1.2.0

1.2.1

1.2.2

1.2.3

1.2.4

1.2.5

1.2.6

1.2.7

1.2.8

1.3.0-M1

1.3.0-M2

1.3.0-M3

1.3.0-M4

1.3.0-M5

1.3.0-M5-94d5ec

1.3.0-RC1

1.3.0-RC2

1.3.0-RC3

1.3.0-RC4

1.3.0-RC5

1.3.0

1.3.1

1.3.2

1.3.3

1.3.4

1.3.5

1.3.6

1.3.7

1.3.8

1.3.9

1.3.10

1.3.11

1.3.12

1.3.13

1.4.0-M1

1.4.0-M2

1.4.0-RC1

1.4.0-RC2

1.4.0

1.4.1

1.4.2

1.4.3

1.4.4

1.4.5

1.4.6

1.4.7

1.4.8

1.4.9

1.5.0-M1

1.5.0-M2

1.5.0-RC1

1.5.0-RC2

1.5.0

1.5.1

1.5.2

1.5.3

1.5.4

1.5.5

1.5.6

1.5.7

1.5.8

1.6.0-M1

1.6.0-RC1

1.6.0-RC2

1.6.0

1.6.1

1.6.2

1.7.0-M1

1.7.0-M2

1.7.0-M2-6810fix

1.7.0-M3

1.7.0-RC1

1.7.0-RC2

1.7.0

1.7.1

1.7.2

1.7.3

1.8.0-RC1

1.8.0

1.8.1

1.8.2

1.8.3

1.9.0-M1

1.9.0-RC1

1.9.0-RC2

1.9.0-RC3

1.9.0

1.9.1

1.9.2

1.9.3

1.9.4

1.9.5

1.9.6

1.9.7

1.9.8

1.9.9

1.10.0-M1

1.10.0-RC1

1.10.0-RC2

1.10.0

1.10.1

1.10.2

1.10.3

1.10.4

1.10.5

1.10.6

1.10.7

1.10.8

1.10.9

1.10.10

1.10.11

1.11.0-RC1

1.11.0-RC2

1.11.0

1.11.1

1.11.2

1.11.3

1.11.4

1.11.5

1.11.6

1.11.7

1.12.0-M1

1.12.0-M2

1.12.0-RC1

1.12.0

1.12.1

1.12.2

1.12.3

1.12.4

1.12.5

1.12.6

1.12.7

Database specific

last_known_affected_version_range

"< 1.12.7"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-x4ff-q6h8-v7gw/GHSA-x4ff-q6h8-v7gw.json"