CVE-2016-3105
Mercurial vulnerable to arbitrary code execution when converting Git repos
CVE-2016-3105 is a high vulnerability (CVSS 8.8) in Mercurial, published May 5, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.75%, the 86th percentile. Fixed in mercurial 3.8.
The convert extension in Mercurial before 3.8 might allow context-dependent attackers to execute arbitrary code via a crafted git repository name.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
The convert extension in Mercurial before 3.8 might allow context-dependent attackers to execute arbitrary code via a crafted git repository name.
- Record
CVE-2016-3105- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-284
- Updated
- 2026-11-02
CVE List No score
The convert extension in Mercurial before 3.8 might allow context-dependent attackers to execute arbitrary code via a crafted git repository name.
- Record
CVE-2016-3105- Updated
- 2026-11-02
EUVDEUVD-2016-0016 No score
The convert extension in Mercurial before 3.8 might allow context-dependent attackers to execute arbitrary code via a crafted git repository name.
- Record
EUVD-2016-0016- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-49cw-434h-qc57
Mercurial vulnerable to arbitrary code execution when converting Git repos
The convert extension in Mercurial before 3.8 might allow context-dependent attackers to execute arbitrary code via a crafted git repository name.
- Record
GHSA-49cw-434h-qc57- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-284
- Updated
- 2026-11-02
OSV
The convert extension in Mercurial before 3.8 might allow context-dependent attackers to execute arbitrary code via a crafted git repository name.
- Record
CVE-2016-3105- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2016-3105
The convert extension in Mercurial before 3.8 might allow context-dependent attackers to execute arbitrary code via a crafted git repository name.
- Record
DEBIAN-CVE-2016-3105- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 7 moreShow less
OSVGHSA-49cw-434h-qc57
Mercurial vulnerable to arbitrary code execution when converting Git repos
The convert extension in Mercurial before 3.8 might allow context-dependent attackers to execute arbitrary code via a crafted git repository name.
- Record
GHSA-49cw-434h-qc57- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-284
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2016-3105
The convert extension in Mercurial before 3.8 might allow context-dependent attackers to execute arbitrary code via a crafted git repository name.
- Record
UBUNTU-CVE-2016-3105- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2016-0172 No score
Updated mercurial packages fix security vulnerability
This update fixes possible arbitrary code execution when converting Git repos. Mercurial prior to 3.8 allowed arbitrary code execution when using the convert extension on Git repos with hostile names. This could affect automated code conversion services that allow arbitrary repository names. This is a further side-effect of Git CVE-2015-7545. Reported and fixed by Blake Burkhart.
- Record
MGASA-2016-0172- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10070-1 No score
mercurial-4.0-1.1 on GA media
These are all security issues fixed in the mercurial-4.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10070-1- Updated
- 2026-11-02
OSVPYSEC-2016-28 No score
The convert extension in Mercurial before 3.8 might allow context-dependent attackers to execute arbitrary code via a crafted git repository name.
- Record
PYSEC-2016-28- Updated
- 2026-11-02
OSVSUSE-SU-2016:1442-1 No score
Security update for mercurial
This update for mercurial fixes the following issues:
Security issues fixed:
- CVE-2016-3105: Versionsprior to 3.8 allowed arbitrary code execution when using the convert extension on Git repo. (bsc#978391)
- Record
SUSE-SU-2016:1442-1- Updated
- 2026-11-02
OSVSUSE-SU-2016:1443-1 No score
Security update for mercurial
This update for mercurial fixes the following issues:
Security issues fixed:
- CVE-2016-3105: Versionsprior to 3.8 allowed arbitrary code execution when using the convert extension on Git repo. (bsc#978391)
- Record
SUSE-SU-2016:1443-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mercurialPyPI |
before 3.8 | 3.8 |
mercurialDebian:12 |
before 3.8.1-1 | 3.8.1-1 |
mercurialDebian:13 |
before 3.8.1-1 | 3.8.1-1 |
mercurialDebian:14 |
before 3.8.1-1 | 3.8.1-1 |
mercurialDebian:7 |
before 2.2.2-4+deb7u3, plus listed versions 2.2.2-32.2.2-42.2.2-4+deb7u12.2.2-4+deb7u2 |
2.2.2-4+deb7u3 |
mercurialDebian:8 |
before 3.1.2-2+deb8u3, plus listed versions 3.1.2-23.1.2-2+deb8u13.1.2-2+deb8u2 |
3.1.2-2+deb8u3 |
mercurialPyPI |
before 3.8, plus listed versions 0.8.10.90.9.10.9.20.9.3 Show 45 moreShow less0.9.40.9.51.01.0.11.0.21.11.1.11.1.21.21.2.11.31.3.11.41.4.11.4.21.4.31.51.5.11.5.21.5.31.5.41.61.6.11.6.21.6.31.6.41.71.7.11.7.21.7.31.7.51.81.8.11.8.21.8.31.8.41.91.9.11.9.21.9.32.02.0.12.0.22.12.1.1 |
3.8 |
mercurialMageia:5 |
before 3.1.1-5.2.mga5 | 3.1.1-5.2.mga5 |
mercurialPyPI |
before 3.8-rc, plus listed versions 0.8.10.90.9.10.9.20.9.3 Show 45 moreShow less0.9.40.9.51.01.0.11.0.21.11.1.11.1.21.21.2.11.31.3.11.41.4.11.4.21.4.31.51.5.11.5.21.5.31.5.41.61.6.11.6.21.6.31.6.41.71.7.11.7.21.7.31.7.51.81.8.11.8.21.8.31.8.41.91.9.11.9.21.9.32.02.0.12.0.22.12.1.1 |
3.8-rc |
mercurialSUSE:Linux Enterprise Software Development Kit 12 |
before 2.8.2-9.1 | 2.8.2-9.1 |
Show 5 moreShow less
| Package | Affected | Fixed |
|---|---|---|
mercurialSUSE:Linux Enterprise Software Development Kit 12 SP1 |
before 2.8.2-9.1 | 2.8.2-9.1 |
mercurialSUSE:Linux Enterprise Software Development Kit 11 SP4 |
before 2.3.2-0.14.2 | 2.3.2-0.14.2 |
mercurialUbuntu:14.04:LTS |
before 2.8.2-1ubuntu1.4, plus listed versions 2.6.3-12.7.2-12.8.1-22.8.2-1ubuntu12.8.2-1ubuntu1.3 |
2.8.2-1ubuntu1.4 |
mercurialUbuntu:16.04:LTS |
before 3.7.3-1ubuntu1.1, plus listed versions 3.4-1ubuntu23.6.2-1ubuntu23.7.3-1ubuntu1 |
3.7.3-1ubuntu1.1 |
mercurialopenSUSE:Tumbleweed |
before 4.0-1.1 | 4.0-1.1 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
security.gentoo.org/glsa/201612-19
securityfocus.com/bid/90536
selenic.com/hg/rev/a56296f55a5e
lists.opensuse.org/opensuse-updates/2016-05/msg00082.html
slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.533255
mercurial-scm.org/wiki/WhatsNew
Show 19 moreShow less
debian.org/security/2016/dsa-3570
nvd.nist.gov/vuln/detail/CVE-2016-3105
web.archive.org/web/20200228012056/http://www.securityfocus.com/bid/90536
github.com/pypa/advisory-database/tree/main/vulns/mercurial/PYSEC-2016-28.yaml
security-tracker.debian.org/tracker/CVE-2016-3105
advisories.mageia.org/MGASA-2016-0172.html
bugs.mageia.org/show_bug.cgi?id=18363
access.redhat.com/security/cve/CVE-2016-3105
suse.com/support/update/announcement/2016/suse-su-20161442-1
bugzilla.suse.com/978391
ubuntu.com/security/CVE-2016-3105
cve.org/CVERecord?id=CVE-2016-3105
Left out here: 107 versions. The JSON record has them.