Maven package
org.scala-sbt/sbt
pkg:maven/org.scala-sbt/sbt
Vulnerabilities (2)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-32948 | — | >= 0.9.5, < 1.12.8 | 1.12.8 | Mar 24, 2026 | sbt is a build tool for Scala, Java, and others. From version 0.9.5 to before version 1.12.7, on Windows, sbt uses Process("cmd", "/c", ...) to run VCS commands (git, hg, svn). The URI fragment (branch, tag, revision) is user-controlled via the build definition and passed to thes | ||
| CVE-2023-46122 | — | >= 0.3.4, < 1.9.7 | 1.9.7 | Oct 23, 2023 | sbt is a build tool for Scala, Java, and others. Given a specially crafted zip or JAR file, `IO.unzip` allows writing of arbitrary file. This would have potential to overwrite `/root/.ssh/authorized_keys`. Within sbt's main code, `IO.unzip` is used in `pullRemoteCache` task and ` |
- CVE-2026-32948Mar 24, 2026affected >= 0.9.5, < 1.12.8fixed 1.12.8
sbt is a build tool for Scala, Java, and others. From version 0.9.5 to before version 1.12.7, on Windows, sbt uses Process("cmd", "/c", ...) to run VCS commands (git, hg, svn). The URI fragment (branch, tag, revision) is user-controlled via the build definition and passed to thes
- CVE-2023-46122Oct 23, 2023affected >= 0.3.4, < 1.9.7fixed 1.9.7
sbt is a build tool for Scala, Java, and others. Given a specially crafted zip or JAR file, `IO.unzip` allows writing of arbitrary file. This would have potential to overwrite `/root/.ssh/authorized_keys`. Within sbt's main code, `IO.unzip` is used in `pullRemoteCache` task and `