CVE-2026-32948
sbt: Source dependency feature (via crafted VCS URL) leads to arbitrary code execution on Windows
sbt is a build tool for Scala, Java, and others. From version 0.9.5 to before version 1.12.7, on Windows, sbt uses Process("cmd", "/c", ...) to run VCS commands (git, hg, svn). The URI fragment (branch, tag, revision) is user-controlled via the build definition and passed to these commands without validation. Because cmd /c interprets &, |, and ; as command separators, a malicious fragment can execute arbitrary commands. This issue has been patched in version 1.12.7.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Active
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
sbt: Source dependency feature (via crafted VCS URL) leads to arbitrary code execution on Windows
sbt is a build tool for Scala, Java, and others. From version 0.9.5 to before version 1.12.7, on Windows, sbt uses Process("cmd", "/c", ...) to run VCS commands (git, hg, svn). The URI fragment (branch, tag, revision) is user-controlled via the build definition and passed to these commands without validation. Because cmd /c interprets &, |, and ; as command separators, a malicious fragment can execute arbitrary commands. This issue has been patched in version 1.12.7.
- Record
CVE-2026-32948- CVSS 4.0
- 6.7 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-78
- Updated
- 2026-11-02
EUVDEUVD-2026-14990
sbt is a build tool for Scala, Java, and others. From version 0.9.5 to before version 1.12.7, on Windows, sbt uses Process("cmd", "/c", ...) to run VCS commands (git, hg, svn). The URI fragment (branch, tag, revision) is user-controlled via the build definition and passed to these commands without validation. Because cmd /c interprets &, |, and ; as command separators, a malicious fragment can execute arbitrary commands. This issue has been patched in version 1.12.7.
- Record
EUVD-2026-14990- CVSS 4.0
- 6.7 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-x4ff-q6h8-v7gw
sbt: Source dependency feature (via crafted VCS URL) leads to arbitrary code execution on Windows
Summary
On Windows, sbt uses Process("cmd", "/c", ...) to run VCS commands (git, hg, svn). The URI fragment (branch, tag, revision) is user-controlled via the build definition and passed to these commands without validation. Because cmd /c interprets &, |, and ; as command separators, a malicious fragment can execute arbitrary commands.
Patched version
Technically, sbt 1.12.7 is patched, but it has a bug that makes source dependency non-functional, so update to sbt 1.12.8 or later instead.
Details
- Resolvers.scala L84–95 — git resolver passes
uri.getFragment()torun()without sanitization - Resolvers.scala L137–145 —
run()usesProcess("cmd", "/c", ...)on Windows, socmdinterprets&&as command separator
PoC
# build.properties
# sbt.version=1.12.5 # Tested on those two versions of sbt
sbt.version=2.0.0-RC9
// build.sbt
ThisBuild / scalaVersion := "2.12.19"
lazy val root = project
.in(file("."))
.dependsOn(vulnerable)
lazy val vulnerable = RootProject(
uri("https://github.com/sbt/io.git#develop%26%26calc.exe")
)
Impact
Windows users are impacted. An attacker can execute arbitrary Windows commands if they control the dependency URI.
- Record
GHSA-x4ff-q6h8-v7gw- CVSS 4.0
- 6.7 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-78
- Updated
- 2026-11-02
NVD
sbt is a build tool for Scala, Java, and others. From version 0.9.5 to before version 1.12.7, on Windows, sbt uses Process("cmd", "/c", ...) to run VCS commands (git, hg, svn). The URI fragment (branch, tag, revision) is user-controlled via the build definition and passed to these commands without validation. Because cmd /c interprets &, |, and ; as command separators, a malicious fragment can execute arbitrary commands. This issue has been patched in version 1.12.7.
- Record
CVE-2026-32948- CVSS 4.0
- 6.7 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-78
- Updated
- 2026-11-02
OSV
sbt: Source dependency feature (via crafted VCS URL) leads to arbitrary code execution on Windows
sbt is a build tool for Scala, Java, and others. From version 0.9.5 to before version 1.12.7, on Windows, sbt uses Process("cmd", "/c", ...) to run VCS commands (git, hg, svn). The URI fragment (branch, tag, revision) is user-controlled via the build definition and passed to these commands without validation. Because cmd /c interprets &, |, and ; as command separators, a malicious fragment can execute arbitrary commands. This issue has been patched in version 1.12.7.
- Record
CVE-2026-32948- CVSS 4.0
- 6.7 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-78
- Updated
- 2026-11-02
OSVGHSA-x4ff-q6h8-v7gw
sbt: Source dependency feature (via crafted VCS URL) leads to arbitrary code execution on Windows
Summary
On Windows, sbt uses Process("cmd", "/c", ...) to run VCS commands (git, hg, svn). The URI fragment (branch, tag, revision) is user-controlled via the build definition and passed to these commands without validation. Because cmd /c interprets &, |, and ; as command separators, a malicious fragment can execute arbitrary commands.
Patched version
Technically, sbt 1.12.7 is patched, but it has a bug that makes source dependency non-functional, so update to sbt 1.12.8 or later instead.
Details
- Resolvers.scala L84–95 — git resolver passes
uri.getFragment()torun()without sanitization - Resolvers.scala L137–145 —
run()usesProcess("cmd", "/c", ...)on Windows, socmdinterprets&&as command separator
PoC
# build.properties
# sbt.version=1.12.5 # Tested on those two versions of sbt
sbt.version=2.0.0-RC9
// build.sbt
ThisBuild / scalaVersion := "2.12.19"
lazy val root = project
.in(file("."))
.dependsOn(vulnerable)
lazy val vulnerable = RootProject(
uri("https://github.com/sbt/io.git#develop%26%26calc.exe")
)
Impact
Windows users are impacted. An attacker can execute arbitrary Windows commands if they control the dependency URI.
- Record
GHSA-x4ff-q6h8-v7gw- CVSS 4.0
- 6.7 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-78
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.scala-sbt:sbtMaven |
0.9.5 up to 1.12.7 | 1.12.7 |
org.scala-sbt:sbtMaven |
0.9.5 up to 1.12.8, plus listed versions 0.99.20.99.41.0.01.0.0-M11.0.0-M2 Show 45 moreShow less1.0.0-M31.0.0-M41.0.0-M51.0.0-M61.0.0-RC11.0.0-RC21.0.0-RC31.0.11.0.21.0.31.0.41.1.01.1.0-M11.1.0-RC11.1.0-RC21.1.0-RC31.1.0-RC41.1.11.1.21.1.31.1.41.1.51.1.61.10.01.10.0-M11.10.0-RC11.10.0-RC21.10.11.10.101.10.111.10.21.10.31.10.41.10.51.10.61.10.71.10.81.10.91.11.01.11.0-RC11.11.0-RC21.11.11.11.21.11.31.11.4 |
1.12.8 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-32948 is a medium vulnerability (CVSS 6.7) in Sbt, published March 24, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.31%, the 23rd percentile. Fixed in org.scala-sbt:sbt 1.12.7.
References
github.com/sbt/sbt/security/advisories/GHSA-x4ff-q6h8-v7gw
nvd.nist.gov/vuln/detail/CVE-2026-32948
Left out here: 114 versions. The JSON record has them.