Sign in
Deutsch English Español Polski
Critical

In Mercurial before 4.4.1, it is possible that a specially malformed repository can cause Git subrepositories to run arbitrary code in the form of a .git/hooks/post-update script checked into the repo

  • Disclosed: 07.12.2017
  • Updated: 11.10.2026 12:20

In Mercurial before 4.4.1, it is possible that a specially malformed repository can cause Git subrepositories to run arbitrary code in the form of a .git/hooks/post-update script checked into the repository. Typical use of Mercurial prevents construction of such repositories, but they can be created programmatically.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Python (PyPI) mercurial < 4.4.1 4.4.1

References

CVSS score 9.8/10
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE)
CWE-78
Platform
Python (PyPI)
Package
mercurial
Disclosed
07.12.2017
Updated
11.10.2026 12:20

Sources and licenses

OSV / GitHub Advisory Database - GHSA-6v56-cpg6-3rpx - CC BY 4.0

OSV / GitHub Advisory Database - PYSEC-2017-90 - PyPA Advisory Database; CC BY 4.0

Vulnerability history: mercurial

All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (18) in the archive
Total entries
18
First → latest
03.2015 05.2022
Without a fix
0
Exploited in attacks
0

Severity breakdown

  • Critical 6
  • High 9
  • Medium 3

Disclosures per year

earlier: 5

Severity:
  1. Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows and OS X; Apple Xcode before 6.2 beta 3; m
    Critical · 9.8 CVE-2014-9390 < 3.2.3 3.2.3
  2. cext/manifest.c in Mercurial before 4.7.2 has an out-of-bounds read during parsing of a malformed manifest entry.
    High · 9.1 CVE-2018-17983 < 4.7.2 4.7.2
  3. mpatch.c in Mercurial before 4.6.1 mishandles integer addition and subtraction, aka OVE-20180430-0002.
    Critical · 9.8 CVE-2018-13347 < 4.6.1 4.6.1
  4. The mpatch_apply function in mpatch.c in Mercurial before 4.6.1 incorrectly proceeds in cases where the fragment start is past the end of the original data, aka OVE-20180430-0004.
    High · 7.5 CVE-2018-13346 < 4.6.1 4.6.1
  5. The mpatch_decode function in mpatch.c in Mercurial before 4.6.1 mishandles certain situations where there should be at least 12 bytes remaining after the current position in the patch data, but actua
    High · 7.5 CVE-2018-13348 < 4.6.1 4.6.1
  6. Mercurial version 4.5 and earlier contains a Incorrect Access Control (CWE-285) vulnerability in Protocol server that can result in Unauthorized data access. This attack appear to be exploitable via n
    Critical · 9.1 CVE-2018-1000132 < 4.5.1 4.5.1
  7. In Mercurial before 4.4.1, it is possible that a specially malformed repository can cause Git subrepositories to run arbitrary code in the form of a .git/hooks/post-update script checked into the repo this entry
    Critical · 9.8 CVE-2017-17458 < 4.4.1 4.4.1
  8. Mercurial prior to 4.3 did not adequately sanitize hostnames passed to ssh, leading to possible shell-injection attacks.
    Critical · 9.8 CVE-2017-1000116 < 4.3 4.3
  9. Mercurial prior to version 4.3 is vulnerable to a missing symlink check that can malicious repositories to modify files outside the repository
    High · 7.5 CVE-2017-1000115 < 4.3 4.3
  10. Mercurial has Incorrect Permission Assignment for Critical Resource
    High · 8.8 CVE-2017-9462 < 4.1.3 4.1.3
  11. The convert extension in Mercurial before 3.8 might allow context-dependent attackers to execute arbitrary code via a crafted git repository name.
    High · 8.8 CVE-2016-3105 < 3.8-rc 3.8-rc
  12. The binary delta decoder in Mercurial before 3.7.3 allows remote attackers to execute arbitrary code via a (1) clone, (2) push, or (3) pull command, related to (a) a list sizing rounding error and (b)
    High · 8.8 CVE-2016-3630 < 3.7.3 3.7.3
  13. Mercurial before 3.7.3 allows remote attackers to execute arbitrary code via a crafted name when converting a Git repository.
    High · 8.8 CVE-2016-3069 < 3.7.3 3.7.3
  14. Mercurial before 3.7.3 allows remote attackers to execute arbitrary code via a crafted git ext:: URL when cloning a subrepository.
    High · 8.8 CVE-2016-3068 < 3.7.3 3.7.3
  15. The _validaterepo function in sshpeer in Mercurial before 3.2.4 allows remote attackers to execute arbitrary commands via a crafted repository name in a clone command.
    Critical · 9.8 CVE-2014-9462 < 3.2.4 3.2.4

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.