CVE-2026-32948CWE-78

sbt: Source dependency feature (via crafted VCS URL) leads to arbitrary code execution on Windows

Medium · published March 24, 2026

CVSS v4.0
6.7
EPSS
0%
Percentile
19.3
In the wild
Unconfirmed
What it is

sbt is a build tool for Scala, Java, and others. From version 0.9.5 to before version 1.12.7, on Windows, sbt uses Process("cmd", "/c", ...) to run VCS commands (git, hg, svn). The URI fragment (branch, tag, revision) is user-controlled via the build definition and passed to these commands without validation. Because cmd /c interprets &, |, and ; as command separators, a malicious fragment can execute arbitrary commands. This issue has been patched in version 1.12.7.

The record
Technical detail
CVSS v4.0
6.7 · MEDIUM
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00279 · 19.3th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-03-24T18:48Z
EPSS history
Timeline
  • 24 MAR 18:48Z
    sbt: Source dependency feature (via crafted VCS URL) leads to arbitrary code execution on Windows
    cvelistv5