High severity8.8NVD Advisory· Published May 9, 2016· Updated May 6, 2026
CVE-2016-3105
CVE-2016-3105
Description
The convert extension in Mercurial before 3.8 might allow context-dependent attackers to execute arbitrary code via a crafted git repository name.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
mercurialPyPI | < 3.8 | 3.8 |
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
11- github.com/advisories/GHSA-49cw-434h-qc57ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2016-3105ghsaADVISORY
- www.mercurial-scm.org/wiki/WhatsNewnvdVendor AdvisoryWEB
- lists.opensuse.org/opensuse-updates/2016-05/msg00082.htmlnvdWEB
- www.debian.org/security/2016/dsa-3570nvdWEB
- www.slackware.com/security/viewer.phpnvdWEB
- github.com/pypa/advisory-database/tree/main/vulns/mercurial/PYSEC-2016-28.yamlghsaWEB
- security.gentoo.org/glsa/201612-19nvdWEB
- selenic.com/hg/rev/a56296f55a5envdWEB
- web.archive.org/web/20200228012056/http://www.securityfocus.com/bid/90536ghsaWEB
- www.securityfocus.com/bid/90536nvd
News mentions
0No linked articles in our index yet.