CVE-2026-32948 sbt: Source dependency feature (via crafted VCS URL) leads to arbitrary code execution on Windows
A command injection vulnerability in sbt allows arbitrary code execution on Windows via crafted VCS URLs in build definitions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-32948?
CVE-2026-32948 is a medium-severity command injection vulnerability in sbt, published on 24 Mar 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
sbt is a build tool for Scala, Java, and others. From version 0.9.5 to before version 1.12.7, on Windows, sbt uses Process("cmd", "/c", ...) to run VCS commands (git, hg, svn). The URI fragment (branch, tag, revision) is user-controlled via the build definition and passed to these commands without validation. Because cmd /c interprets &, |, and ; as command separators, a malicious fragment can execute arbitrary commands. This issue has been patched in version 1.12.7.
Weakness: CWE-78
Which versions are affected by CVE-2026-32948?
2 open source packages ship an affected version, including org.scala-sbt:sbt. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.scala-sbt:sbt Maven | From 0.9.5 | 1.12.8 |
org.scala-sbt:sbt Maven | From 0.9.5 | 1.12.8 |
Products include Scala.epfl Sbt.
How do I fix CVE-2026-32948?
Upgrade org.scala-sbt:sbt to 1.12.8 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-32948 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-32948 exists.
Sources
Also known as GHSA-x4ff-q6h8-v7gw.