CVE-2026-32948: sbt Remote Code Execution Vulnerability
MODERATECVE-2026-32948 is a MODERATE remote code execution vulnerability (CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')) affecting sbt libraries in the Maven ecosystem. The issue involves source dependency feature (via crafted vcs url) leads to arbitrary code execution on windows. Remediation is available by upgrading affected packages to version 1.12.8.
CVE-2026-32948 at a Glance
How to Fix CVE-2026-32948
To remediate this vulnerability, upgrade all affected sbt dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
<dependency>
<groupId>org.scala-sbt</groupId>
<artifactId>sbt</artifactId>
<version>1.12.8</version>
</dependency>Run the following command in your project directory to verify that all resolved dependencies use the patched release:
mvn dependency:tree -Dincludes=org.scala-sbtHow to Check if You Are Affected
To determine whether your Java application is affected by CVE-2026-32948, inspect your build dependencies using the Maven Dependency Plugin:
mvn dependency:tree -Dincludes=org.scala-sbtAnalyze the terminal output to locate any version of sbt in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 1.12.8), your application is affected.
Note: The mvn dependency:tree -Dincludes=org.scala-sbt command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), where the product constructs all or part of an os command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended os command when it is sent to a downstream component. In sbt, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2026-32948 Affected sbt Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
org.scala-sbt:sbt
|
Maven |
≥ 0.9.5
< 1.12.8
|
1.12.8
|
References
Frequently Asked Questions
What is CVE-2026-32948?
Which sbt versions are affected?
What version fixes CVE-2026-32948?
Is sbt affected?
What CWE is associated with CVE-2026-32948?
How can I check Maven dependencies for CVE-2026-32948?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-x4ff-q6h8-v7gw",
"modified" : "2026-03-27T21:57:02Z",
"published" : "2026-03-24T16:04:12Z",
"aliases" : [ "CVE-2026-32948" ],
"summary" : "sbt: Source dependency feature (via crafted VCS URL) leads to arbitrary code execution on Windows",
"details" : "### Summary\nOn Windows, sbt uses `Process(\"cmd\", \"/c\", ...)` to run VCS commands (git, hg, svn). The URI fragment (branch, tag, revision) is user-controlled via the build definition and passed to these commands without validation. Because `cmd /c` interprets `&`, `|`, and `;` as command separators, a malicious fragment can execute arbitrary commands.\n\n### Patched version\n\nTechnically, sbt 1.12.7 is patched, but it has a bug that makes source dependency non-functional, so update to **sbt 1.12.8** or later instead.\n\n### Details\n- [Resolvers.scala L84–95](https://github.com/sbt/sbt/blob/dc90f160dfb563f46fd1a7b97945c381d15e2a6c/main/src/main/scala/sbt/Resolvers.scala#L84-L95) — git resolver passes `uri.getFragment()` to `run()` without sanitization\n- [Resolvers.scala L137–145](https://github.com/sbt/sbt/blob/dc90f160dfb563f46fd1a7b97945c381d15e2a6c/main/src/main/scala/sbt/Resolvers.scala#L137-L145) — `run()` uses `Process(\"cmd\", \"/c\", ...)` on Windows, so `cmd` interprets `&&` as command separator\n\n### PoC\n```sh\n# build.properties\n# sbt.version=1.12.5 # Tested on those two versions of sbt\nsbt.version=2.0.0-RC9\n```\n\n```scala\n// build.sbt\n\nThisBuild / scalaVersion := \"2.12.19\"\n\nlazy val root = project\n .in(file(\".\"))\n .dependsOn(vulnerable)\n\nlazy val vulnerable = RootProject(\n uri(\"https://github.com/sbt/io.git#develop%26%26calc.exe\")\n)\n```\n\n### Impact\n\nWindows users are impacted. An attacker can execute arbitrary Windows commands if they control the dependency URI.",
"severity" : [ {
"type" : "CVSS_V4",
"score" : "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "Maven",
"name" : "org.scala-sbt:sbt"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0.9.5"
}, {
"fixed" : "1.12.8"
} ]
} ],
"database_specific" : {
"last_known_affected_version_range" : "< 1.12.7"
}
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/sbt/sbt/security/advisories/GHSA-x4ff-q6h8-v7gw"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-32948"
}, {
"type" : "WEB",
"url" : "https://github.com/sbt/sbt/commit/1ce945b6b79cbe3cef6c0fe9efbbd2904e0f479e"
}, {
"type" : "WEB",
"url" : "https://github.com/sbt/sbt/commit/3a474ab060df4dbfa825a7e7bc97e00056519800"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/sbt/sbt"
}, {
"type" : "WEB",
"url" : "https://github.com/sbt/sbt/releases/tag/v1.12.7"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-78" ],
"severity" : "MODERATE",
"github_reviewed" : true,
"github_reviewed_at" : "2026-03-24T16:04:12Z",
"nvd_published_at" : "2026-03-24T20:16:27Z"
}
}