Critical severityNVD Advisory· Published Mar 31, 2015· Updated Jun 17, 2026
CVE-2014-9462
CVE-2014-9462
Description
The _validaterepo function in sshpeer in Mercurial before 3.2.4 allows remote attackers to execute arbitrary commands via a crafted repository name in a clone command.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
mercurialPyPI | < 3.2.4 | 3.2.4 |
Affected products
5- ghsa-coords2 versionspkg:pypi/mercurialpkg:rpm/suse/mercurial&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012
< 3.2.4+ 1 more
- (no CPE)range: < 3.2.4
- (no CPE)range: < 2.8.2-3.1
Patches
Vulnerability mechanics
References
10- chargen.matasano.com/chargen/2015/3/17/this-new-vulnerability-mercurial-command-injection-cve-2014-9462.htmlnvdExploitWEB
- mercurial.selenic.com/wiki/WhatsNewnvdVendor AdvisoryWEB
- github.com/advisories/GHSA-3pmw-h7j4-rf54ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2014-9462ghsaADVISORY
- lists.opensuse.org/opensuse-updates/2015-03/msg00085.htmlnvdWEB
- www.debian.org/security/2015/dsa-3257nvdWEB
- www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.htmlnvdWEB
- github.com/pypa/advisory-database/tree/main/vulns/mercurial/PYSEC-2015-14.yamlghsaWEB
- security.gentoo.org/glsa/201612-19nvdWEB
- www.osvdb.org/119816nvd
News mentions
0No linked articles in our index yet.