CVE-2026-32948
Command Injection in sbt VCS URI Handling on Windows
Publication date: 2026-03-24
Last updated on: 2026-03-26
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| scala.epfl | sbt | From 0.9.5 (inc) to 1.12.7 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-78 | The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in sbt, a build tool for Scala, Java, and others, specifically on Windows versions from 0.9.5 to before 1.12.7. sbt uses the Windows command processor (cmd /c) to run version control system (VCS) commands like git, hg, and svn. The problem arises because the URI fragment (such as branch, tag, or revision), which is user-controlled via the build definition, is passed directly to these commands without any validation.
Since cmd /c interprets special characters like &, |, and ; as command separators, a maliciously crafted URI fragment can inject and execute arbitrary commands on the system. This means an attacker can run unintended commands by exploiting this flaw.
This issue was fixed in sbt version 1.12.7.
How can this vulnerability impact me? :
This vulnerability can allow an attacker to execute arbitrary commands on your Windows system when using vulnerable versions of sbt. Because the user-controlled URI fragment is passed without validation to the command line, an attacker could inject malicious commands that the system would execute.
The impact includes potential unauthorized actions such as modifying files, installing malware, or compromising the system's integrity and confidentiality.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, upgrade sbt to version 1.12.7 or later, where the issue has been patched.