Medium

sbt: Source dependency feature (via crafted VCS URL) leads to arbitrary code execution on Windows

Disclosed: 24.03.2026
Updated: 11.10.2026 12:22

Summary

On Windows, sbt uses Process("cmd", "/c", ...) to run VCS commands (git, hg, svn). The URI fragment (branch, tag, revision) is user-controlled via the build definition and passed to these commands without validation. Because cmd /c interprets &, |, and ; as command separators, a malicious fragment can execute arbitrary commands.

Patched version

Technically, sbt 1.12.7 is patched, but it has a bug that makes source dependency non-functional, so update to sbt 1.12.8 or later instead.

Details

Resolvers.scala L84–95 — git resolver passes uri.getFragment() to run() without sanitization
Resolvers.scala L137–145 — run() uses Process("cmd", "/c", ...) on Windows, so cmd interprets && as command separator

PoC

bash

# build.properties
# sbt.version=1.12.5  # Tested on those two versions of sbt
sbt.version=2.0.0-RC9

scala

// build.sbt

ThisBuild / scalaVersion := "2.12.19"

lazy val root = project
  .in(file("."))
  .dependsOn(vulnerable)

lazy val vulnerable = RootProject(
  uri("https://github.com/sbt/io.git#develop%26%26calc.exe")
)

Impact

Windows users are impacted. An attacker can execute arbitrary Windows commands if they control the dependency URI.

Affected software

Click a technology to see all vulnerabilities affecting it.

Platform	Package	Vulnerable versions	Fixed in
Java / Kotlin (Maven)	org.scala-sbt:sbt	>= 0.9.5, < 1.12.8	1.12.8

References

CVSS score -

CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Weakness (CWE): CWE-78
Platform: Java / Kotlin (Maven)
Package: org.scala-sbt:sbt
Disclosed: 24.03.2026
Updated: 11.10.2026 12:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-x4ff-q6h8-v7gw - CC BY 4.0

Vulnerability history: org.scala-sbt:sbt

All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.

Total entries: 2
First → latest: 10.2023 03.2026
Without a fix: 0
Exploited in attacks: 0

Severity breakdown

Medium 1
Low 1

Disclosures per year

2023: 1
2024: 0
2025: 0
2026: 1

24.03.2026

sbt: Source dependency feature (via crafted VCS URL) leads to arbitrary code execution on Windows this entry

Medium CVE-2026-32948 >= 0.9.5, < 1.12.8 1.12.8
24.10.2023

sbt vulnerable to arbitrary file write via archive extraction (Zip Slip)

Low · 3.9 CVE-2023-46122 >= 0.3.4, < 1.9.7 1.9.7

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application