{"id":"CVE-2026-104026","aliases":["EUVD-2026-91648","GHSA-g4x4-gm4c-5r8h"],"status":"published","title":"In Sapling SCM prior to v0.2.20260929-102736, control characters were allowed to be embedded in...","description":"In Sapling SCM prior to v0.2.20260929-102736, control characters were allowed to be embedded in Git subtree URLs. A maliciously constructed repository, if cloned by a target, could trigger code execution on otherwise read-only actions such as sl log/blame/annotate.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00126,"percentile":0.0231,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-150"],"published":"2026-10-02T14:06:02Z","modified":"2026-10-02T18:44:11Z","products":[{"vendor":"meta platforms, inc","product":"sapling scm"}],"references":[{"url":"https://www.facebook.com/security/advisories/cve-2026-104026","tags":["x_refsource_CONFIRM"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104026"},{"url":"https://github.com/advisories/GHSA-g4x4-gm4c-5r8h"}],"sources":{"cve":[{"id":"CVE-2026-104026","description":"In Sapling SCM prior to v0.2.20260929-102736, control characters were allowed to be embedded in Git subtree URLs. A maliciously constructed repository, if cloned by a target, could trigger code execution on otherwise read-only actions such as sl log/blame/annotate.","status":"published","published":"2026-10-02T14:06:02.38Z","modified":"2026-10-02T14:30:01.53Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-150"],"updated_at":"2026-11-02T14:20:09.448255Z"}],"euvd":[{"id":"EUVD-2026-91648","description":"In Sapling SCM prior to v0.2.20260929-102736, control characters were allowed to be embedded in Git subtree URLs. A maliciously constructed repository, if cloned by a target, could trigger code execution on otherwise read-only actions such as sl log/blame/annotate.","status":"published","published":"2026-10-02T14:06:02Z","modified":"2026-10-02T14:30:01Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T17:27:42.693498Z"}],"ghsa":[{"id":"GHSA-g4x4-gm4c-5r8h","title":"In Sapling SCM prior to v0.2.20260929-102736, control characters were allowed to be embedded in...","description":"In Sapling SCM prior to v0.2.20260929-102736, control characters were allowed to be embedded in Git subtree URLs. A maliciously constructed repository, if cloned by a target, could trigger code execution on otherwise read-only actions such as sl log/blame/annotate.","status":"published","published":"2026-10-02T15:31:26Z","modified":"2026-10-02T15:31:37Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-150"],"updated_at":"2026-11-02T15:12:43.646433Z"}],"nvd":[{"id":"CVE-2026-104026","description":"In Sapling SCM prior to v0.2.20260929-102736, control characters were allowed to be embedded in Git subtree URLs. A maliciously constructed repository, if cloned by a target, could trigger code execution on otherwise read-only actions such as sl log/blame/annotate.","status":"published","published":"2026-10-02T15:17:05.453Z","modified":"2026-10-02T18:44:11.27Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-150"],"updated_at":"2026-11-02T14:12:53.75133Z"}]}}