sbt vulnerable to arbitrary file write via archive extraction (Zip Slip)
Impact
Given specially crafted zip or JAR file, IO.unzip allows writing of arbitrary file. The follow is an example of a malicious entry:
+2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keysThis would have a potential to overwrite /root/.ssh/authorized_keys. Within sbt's main code, IO.unzip is used in pullRemoteCache task and Resolvers.remote; however many projects use IO.unzip(...) directly to implement custom tasks - https://github.com/search?q=IO.unzip+language%3AScala&type=code&l=Scala&p=1
Patches
The problem has been patched in https://github.com/sbt/io/pull/360 sbt 1.9.7 is available with the fix.
Workarounds
A workaround might be use some other library to unzip.
References
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Java / Kotlin (Maven) | org.scala-sbt:io_2.12 | >= 1.0.0, < 1.9.7 | 1.9.7 |
| Java / Kotlin (Maven) | org.scala-sbt:io_2.13 | >= 1.0.0, < 1.9.7 | 1.9.7 |
| Java / Kotlin (Maven) | org.scala-sbt:io_3 | >= 1.0.0, < 1.9.7 | 1.9.7 |
| Java / Kotlin (Maven) | org.scala-sbt:sbt | >= 0.3.4, < 1.9.7 | 1.9.7 |
References
- CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L- Weakness (CWE)
CWE-22- Platform
- Java / Kotlin (Maven)
- Package
org.scala-sbt:io_2.12, org.scala-sbt:io_2.13, org.scala-sbt:io_3- Disclosed
- 24.10.2023
- Updated
- 11.10.2026 11:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-h9mw-grgx-2fhf - CC BY 4.0
Vulnerability history: org.scala-sbt:io_2.12
All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.
This is the only known vulnerability of this package.
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.