sbt: Source dependency feature (via crafted VCS URL) leads to arbitrary code execution on Windows
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Active
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Code execution
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-78.
Summary
sbt is a build tool for Scala, Java, and others. From version 0.9.5 to before version 1.12.7, on Windows, sbt uses Process("cmd", "/c", ...) to run VCS commands (git, hg, svn). The URI fragment (branch, tag, revision) is user-controlled via the build definition and passed to these commands without validation. Because cmd /c interprets &, |, and ; as command separators, a malicious fragment can execute arbitrary commands. This issue has been patched in version 1.12.7.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| sbt | sbt | 0.9.5 to before 1.12.7 | 1.12.7 | Patch available | CNA |
| — | org.scala-sbt:sbt (Maven) | 0.9.5 to before 1.12.8 | 1.12.8 | Patch available | GHSA-x4ff-q6h8-v7gw |
- sbt Vendorsbt Affected 0.9.5 to before 1.12.7 Fixed in 1.12.7 Patch available CNA
- org.scala-sbt:sbt (Maven) Vendor— Affected 0.9.5 to before 1.12.8 Fixed in 1.12.8 Patch available GHSA-x4ff-q6h8-v7gw
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:scala.epfl:sbt:*:*:*:*:*:*:*:* | 0.9.5 to before 1.12.7 | Vulnerable | Scala.epfl |
| cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
- cpe:2.3:a:scala.epfl:sbt:*:*:*:*:*:*:*:* Versions 0.9.5 to before 1.12.7 Vulnerable ·Scala.epfl
- cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
Remediation
- Fix · CNA sbt (sbt) Fixed in 1.12.7
- Fix · GHSA-x4ff-q6h8-v7gw org.scala-sbt:sbt (Maven) Fixed in 1.12.8 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
Not affected: 3 products
- Red Hat JBoss Enterprise Application Platform 7
- Red Hat JBoss Enterprise Application Platform 8
- Red Hat JBoss Enterprise Application Platform Expansion Pack
Timeline
- 2026-10-02 Threatist record created from CVE-2026-32948
- 2026-10-03 Alias added: GHSA-x4ff-q6h8-v7gw
References
Patch 2
Sources
- CVE-2026-32948 · CVE Program
- CVE-2026-32948 · NVD
- FIRST EPSS
- GHSA-x4ff-q6h8-v7gw · GitHub Advisory Database · CC BY 4.0
- CVE-2026-32948 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences