CVE-2026-32948

HIGH

sbt: Source dependency feature (via crafted VCS URL) leads to arbitrary code execution on Windows

Title source: cna
STIX 2.1

Description

sbt is a build tool for Scala, Java, and others. From version 0.9.5 to before version 1.12.7, on Windows, sbt uses Process("cmd", "/c", ...) to run VCS commands (git, hg, svn). The URI fragment (branch, tag, revision) is user-controlled via the build definition and passed to these commands without validation. Because cmd /c interprets &, |, and ; as command separators, a malicious fragment can execute arbitrary commands. This issue has been patched in version 1.12.7.

References (4)

Core 4

Scores

CVSS v3 7.8
EPSS 0.0030
EPSS Percentile 21.9%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact total

Details

CWE
CWE-78
Status published
Products (3)
org.scala-sbt/sbt 0.9.5 - 1.12.8Maven
sbt/sbt >= 0.9.5, < 1.12.7
scala.epfl/sbt 0.9.5 - 1.12.7
Published Mar 24, 2026
Tracked Since Mar 25, 2026