TI-2014-07689 Aliases CVE-2014-9462 GHSA-3pmw-h7j4-rf54

The _validaterepo function in sshpeer in Mercurial before 3.2.4 allows remote attackers…

MEDIUM 40CWE-20Published 2015-03-31 · Updated 2024-08-06

Key facts

Attack vector: Network
Privileges required: None
User interaction: — Not recorded in CVSS 2.0
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: Partial · Partial · Partial
Fix status: Partial Red Hat: 2 without a fix

Attack profile from CVSS 2.0 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

The _validaterepo function in sshpeer in Mercurial before 3.2.4 allows remote attackers to execute arbitrary commands via a crafted repository name in a clone command.

Why it matters now

EPSS 0.04169 90th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Partial mercurial (PyPI): 3.2.4Red Hat: 2 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA
—	mercurial (PyPI)	before 3.2.4	3.2.4	Patch available	GHSA-3pmw-h7j4-rf54

— Vendor— Affected all versions Fixed in — No fix listed CNA
mercurial (PyPI) Vendor— Affected before 3.2.4 Fixed in 3.2.4 Patch available GHSA-3pmw-h7j4-rf54

CPE configurations NVD · 3

CPE	Versions	Role	Vendor
cpe:2.3:o:opensuse:opensuse:13.1:::::::*	13.1	Vulnerable	openSUSE
cpe:2.3:o:opensuse:opensuse:13.2:::::::*	13.2	Vulnerable	openSUSE
cpe:2.3:a:mercurial:mercurial::::::::	up to 3.2.3	Vulnerable	Mercurial

cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:* Versions 13.1 Vulnerable ·openSUSE
cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:* Versions 13.2 Vulnerable ·openSUSE
cpe:2.3:a:mercurial:mercurial:*:*:*:*:*:*:*:* Versions up to 3.2.3 Vulnerable ·Mercurial

Remediation

Fix · GHSA-3pmw-h7j4-rf54 mercurial (PyPI) Fixed in 3.2.4 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux 6	Affected	No fix planned: Will not fix
Red Hat Enterprise Linux 7	Affected	No fix planned: Will not fix

Timeline

2026-10-02 Threatist record created from CVE-2014-9462
2026-10-03 Alias added: GHSA-3pmw-h7j4-rf54

References

Exploit 1

http://chargen.matasano.com/chargen/2015/3/17/this-new-vulnerability-mercurial-command-injection-cve-2014-9462.html

Advisory 5

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences