Every CVE Search/ Get API key

CVE-2017-9462

Mercurial has Incorrect Permission Assignment for Critical Resource

8.8 HighPublic exploitFix available

In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and consequently execute arbitrary code, by using --debugger as a repository name.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

21.7%Down 2.1 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 8.8

In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and consequently execute arbitrary code, by using --debugger as a repository name.

Record
CVE-2017-9462
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
9.0 HighAV:N/AC:L/Au:S/C:C/I:C/A:C
Weakness
CWE-732
Updated
2026-11-02
CVE List No score

In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and consequently execute arbitrary code, by using --debugger as a repository name.

Record
CVE-2017-9462
Updated
2026-11-02
EUVDEUVD-2017-0073 No score

In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and consequently execute arbitrary code, by using --debugger as a repository name.

Record
EUVD-2017-0073
Updated
2026-11-03
GitHub AdvisoriesGHSA-ghjx-3jg5-h6r2 8.7

Mercurial has Incorrect Permission Assignment for Critical Resource

In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and consequently execute arbitrary code, by using --debugger as a repository name.

Record
GHSA-ghjx-3jg5-h6r2
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-732
Updated
2026-11-02
OSV 8.8

In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and consequently execute arbitrary code, by using --debugger as a repository name.

Record
CVE-2017-9462
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2017-9462 8.8

In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and consequently execute arbitrary code, by using --debugger as a repository name.

Record
DEBIAN-CVE-2017-9462
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 7 moreShow less
OSVGHSA-ghjx-3jg5-h6r2 8.7

Mercurial has Incorrect Permission Assignment for Critical Resource

In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and consequently execute arbitrary code, by using --debugger as a repository name.

Record
GHSA-ghjx-3jg5-h6r2
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-732
Updated
2026-11-02
OSVRHSA-2017:1576 6.3

Red Hat Security Advisory: mercurial security update

Record
RHSA-2017:1576
CVSS 3.0
6.3 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02
OSVUBUNTU-CVE-2017-9462 8.8

In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and consequently execute arbitrary code, by using --debugger as a repository name.

Record
UBUNTU-CVE-2017-9462
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVMGASA-2017-0182 No score

Updated mercurial packages fix security vulnerability

In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and consequently execute arbitrary code, by using --debugger as a repository name.

Record
MGASA-2017-0182
Updated
2026-11-02
OSVPYSEC-2017-91 No score

In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and consequently execute arbitrary code, by using --debugger as a repository name.

Record
PYSEC-2017-91
Updated
2026-11-02
OSVSUSE-SU-2017:1558-1 No score

Security update for mercurial

This update for mercurial fixes the following issues:

  • CVE-2017-9462: Arbitrary code execution was possible by remote users via 'hg serve --stdio' (bsc#1043063):
Record
SUSE-SU-2017:1558-1
Updated
2026-11-02
OSVSUSE-SU-2017:1606-1 No score

Security update for mercurial

This update for mercurial fixes the following issues:

Security issue fixed:

  • CVE-2017-9462: Fix the arbitrary code exec by remote users via 'hg serve --stdio' (bsc#1043063):
Record
SUSE-SU-2017:1606-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
mercurial
PyPI
 before 4.1.3
4.1.3
mercurial
Debian:12
 before 4.3.1-1
4.3.1-1
mercurial
Debian:13
 before 4.3.1-1
4.3.1-1
mercurial
Debian:14
 before 4.3.1-1
4.3.1-1
mercurial
Debian:7
 before 2.2.2-4+deb7u4, plus listed versions
2.2.2-32.2.2-42.2.2-4+deb7u12.2.2-4+deb7u22.2.2-4+deb7u3
2.2.2-4+deb7u4
mercurial
Debian:8
 before 3.1.2-2+deb8u5, plus listed versions
3.1.2-23.1.2-2+deb8u13.1.2-2+deb8u23.1.2-2+deb8u33.1.2-2+deb8u4
3.1.2-2+deb8u5
mercurial
PyPI
 before 4.1.3, plus listed versions
0.8.10.90.9.10.9.20.9.3
Show 45 moreShow less
0.9.40.9.51.01.0.11.0.21.11.1.11.1.21.21.2.11.31.3.11.41.4.11.4.21.4.31.51.5.11.5.21.5.31.5.41.61.6.11.6.21.6.31.6.41.71.7.11.7.21.7.31.7.51.81.8.11.8.21.8.31.8.41.91.9.11.9.21.9.32.02.0.12.0.22.12.1.1
4.1.3
mercurial
Mageia:5
 before 3.1.1-5.3.mga5
3.1.1-5.3.mga5
emacs-mercurial
Red Hat:enterprise_linux:6::client
 before 0:1.4-5.el6_9
0:1.4-5.el6_9
emacs-mercurial-el
Red Hat:enterprise_linux:6::client
 before 0:1.4-5.el6_9
0:1.4-5.el6_9
Show 42 moreShow less
Affected packages
PackageAffectedFixed
mercurial
Red Hat:enterprise_linux:6::client
 before 0:1.4-5.el6_9
0:1.4-5.el6_9
mercurial-debuginfo
Red Hat:enterprise_linux:6::client
 before 0:1.4-5.el6_9
0:1.4-5.el6_9
mercurial-hgk
Red Hat:enterprise_linux:6::client
 before 0:1.4-5.el6_9
0:1.4-5.el6_9
emacs-mercurial
Red Hat:enterprise_linux:6::computenode
 before 0:1.4-5.el6_9
0:1.4-5.el6_9
emacs-mercurial-el
Red Hat:enterprise_linux:6::computenode
 before 0:1.4-5.el6_9
0:1.4-5.el6_9
mercurial
Red Hat:enterprise_linux:6::computenode
 before 0:1.4-5.el6_9
0:1.4-5.el6_9
mercurial-debuginfo
Red Hat:enterprise_linux:6::computenode
 before 0:1.4-5.el6_9
0:1.4-5.el6_9
mercurial-hgk
Red Hat:enterprise_linux:6::computenode
 before 0:1.4-5.el6_9
0:1.4-5.el6_9
mercurial
Red Hat:enterprise_linux:6::server
 before 0:1.4-5.el6_9
0:1.4-5.el6_9
mercurial-debuginfo
Red Hat:enterprise_linux:6::server
 before 0:1.4-5.el6_9
0:1.4-5.el6_9
emacs-mercurial
Red Hat:enterprise_linux:6::server
 before 0:1.4-5.el6_9
0:1.4-5.el6_9
emacs-mercurial-el
Red Hat:enterprise_linux:6::server
 before 0:1.4-5.el6_9
0:1.4-5.el6_9
mercurial-hgk
Red Hat:enterprise_linux:6::server
 before 0:1.4-5.el6_9
0:1.4-5.el6_9
mercurial
Red Hat:enterprise_linux:6::workstation
 before 0:1.4-5.el6_9
0:1.4-5.el6_9
mercurial-debuginfo
Red Hat:enterprise_linux:6::workstation
 before 0:1.4-5.el6_9
0:1.4-5.el6_9
emacs-mercurial
Red Hat:enterprise_linux:6::workstation
 before 0:1.4-5.el6_9
0:1.4-5.el6_9
emacs-mercurial-el
Red Hat:enterprise_linux:6::workstation
 before 0:1.4-5.el6_9
0:1.4-5.el6_9
mercurial-hgk
Red Hat:enterprise_linux:6::workstation
 before 0:1.4-5.el6_9
0:1.4-5.el6_9
emacs-mercurial
Red Hat:enterprise_linux:7::client
 before 0:2.6.2-7.el7_3
0:2.6.2-7.el7_3
emacs-mercurial-el
Red Hat:enterprise_linux:7::client
 before 0:2.6.2-7.el7_3
0:2.6.2-7.el7_3
mercurial
Red Hat:enterprise_linux:7::client
 before 0:2.6.2-7.el7_3
0:2.6.2-7.el7_3
mercurial-debuginfo
Red Hat:enterprise_linux:7::client
 before 0:2.6.2-7.el7_3
0:2.6.2-7.el7_3
mercurial-hgk
Red Hat:enterprise_linux:7::client
 before 0:2.6.2-7.el7_3
0:2.6.2-7.el7_3
emacs-mercurial
Red Hat:enterprise_linux:7::computenode
 before 0:2.6.2-7.el7_3
0:2.6.2-7.el7_3
emacs-mercurial-el
Red Hat:enterprise_linux:7::computenode
 before 0:2.6.2-7.el7_3
0:2.6.2-7.el7_3
mercurial
Red Hat:enterprise_linux:7::computenode
 before 0:2.6.2-7.el7_3
0:2.6.2-7.el7_3
mercurial-debuginfo
Red Hat:enterprise_linux:7::computenode
 before 0:2.6.2-7.el7_3
0:2.6.2-7.el7_3
mercurial-hgk
Red Hat:enterprise_linux:7::computenode
 before 0:2.6.2-7.el7_3
0:2.6.2-7.el7_3
mercurial
Red Hat:enterprise_linux:7::server
 before 0:2.6.2-7.el7_3
0:2.6.2-7.el7_3
mercurial-debuginfo
Red Hat:enterprise_linux:7::server
 before 0:2.6.2-7.el7_3
0:2.6.2-7.el7_3
emacs-mercurial
Red Hat:enterprise_linux:7::server
 before 0:2.6.2-7.el7_3
0:2.6.2-7.el7_3
emacs-mercurial-el
Red Hat:enterprise_linux:7::server
 before 0:2.6.2-7.el7_3
0:2.6.2-7.el7_3
mercurial-hgk
Red Hat:enterprise_linux:7::server
 before 0:2.6.2-7.el7_3
0:2.6.2-7.el7_3
mercurial
Red Hat:enterprise_linux:7::workstation
 before 0:2.6.2-7.el7_3
0:2.6.2-7.el7_3
mercurial-debuginfo
Red Hat:enterprise_linux:7::workstation
 before 0:2.6.2-7.el7_3
0:2.6.2-7.el7_3
emacs-mercurial
Red Hat:enterprise_linux:7::workstation
 before 0:2.6.2-7.el7_3
0:2.6.2-7.el7_3
emacs-mercurial-el
Red Hat:enterprise_linux:7::workstation
 before 0:2.6.2-7.el7_3
0:2.6.2-7.el7_3
mercurial-hgk
Red Hat:enterprise_linux:7::workstation
 before 0:2.6.2-7.el7_3
0:2.6.2-7.el7_3
mercurial
SUSE:Linux Enterprise Software Development Kit 11 SP4
 before 2.3.2-0.17.1
2.3.2-0.17.1
mercurial
SUSE:Linux Enterprise Software Development Kit 12 SP2
 before 2.8.2-14.1
2.8.2-14.1
mercurial
Ubuntu:14.04:LTS
 before 2.8.2-1ubuntu1.4, plus listed versions
2.6.3-12.7.2-12.8.1-22.8.2-1ubuntu12.8.2-1ubuntu1.3
2.8.2-1ubuntu1.4
mercurial
Ubuntu:16.04:LTS
 before 3.7.3-1ubuntu1.1, plus listed versions
3.4-1ubuntu23.6.2-1ubuntu23.7.3-1ubuntu1
3.7.3-1ubuntu1.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
MetasploitMercurial Custom hg-ssh Wrapper Remote Code Exec2017-04-18

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, Metasploit, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2017-9462 is a high vulnerability (CVSS 8.8) in Mercurial, published June 6, 2017. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 21.7%, the 97th percentile. Fixed in mercurial 4.1.3.

References

Show 21 moreShow less
This page doesn't list everything

Left out here: 71 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open