High severity8.8NVD Advisory· Published Dec 11, 2017· Updated May 13, 2026
CVE-2017-17536
CVE-2017-17536
Description
Phabricator before 2017-11-10 does not block the --config and --debugger flags to the Mercurial hg program, which allows remote attackers to execute arbitrary code by using the web UI to browse a branch whose name begins with a --config= or --debugger= substring.
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
2- secure.phabricator.com/T13012nvdIssue TrackingPatchVendor Advisory
- hackerone.com/reports/288704nvdIssue TrackingThird Party Advisory
News mentions
0No linked articles in our index yet.