Summary
sbt: Source dependency feature (via crafted VCS URL) leads to arbitrary code execution on Windows
On Windows, sbt uses Process("cmd", "/c", ...) to run VCS commands (git, hg, svn). The URI fragment (branch, tag, revision) is user-controlled via the build definition and passed to these commands without validation. Because cmd /c interprets &, |, and ; as command separators, a malicious fragment can execute arbitrary commands.
Patched version
Technically, sbt 1.12.7 is patched, but it has a bug that makes source dependency non-functional, so update to sbt 1.12.8 or later instead.
Details
- Resolvers.scala L84–95, git resolver passes
uri.getFragment()torun()without sanitization - Resolvers.scala L137–145,
run()usesProcess("cmd", "/c", ...)on Windows, socmdinterprets&&as command separator
PoC
# build.properties
# sbt.version=1.12.5 # Tested on those two versions of sbt
sbt.version=2.0.0-RC9
// build.sbt
ThisBuild / scalaVersion := "2.12.19"
lazy val root = project
.in(file("."))
.dependsOn(vulnerable)
lazy val vulnerable = RootProject(
uri("https://github.com/sbt/io.git#develop%26%26calc.exe")
)
Impact
Windows users are impacted. An attacker can execute arbitrary Windows commands if they control the dependency URI.
Untrusted input reaches a shell command, allowing arbitrary commands to run on the host. Typical impact: code execution in the application's environment.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
Kodem Kai can prioritize this vulnerability in your dependency tree and generate a fix recommendation.
Frequently Asked Questions
- What is CVE-2026-32948? CVE-2026-32948 is a medium-severity OS command injection vulnerability in org.scala-sbt:sbt (maven), affecting versions >= 0.9.5, < 1.12.7. It is fixed in 1.12.8. Untrusted input reaches a shell command, allowing arbitrary commands to run on the host.
- Which versions of org.scala-sbt:sbt are affected by CVE-2026-32948? org.scala-sbt:sbt (maven) versions >= 0.9.5, < 1.12.7 is affected.
- Is there a fix for CVE-2026-32948? Yes. CVE-2026-32948 is fixed in 1.12.8. Upgrade to this version or later.
- Is CVE-2026-32948 exploitable, and should I be worried? Whether CVE-2026-32948 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-32948 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-32948? Upgrade
org.scala-sbt:sbtto 1.12.8 or later.