CyberSecBulletin

Sbt vulnerabilities

We track 2 vulnerabilities in Sbt products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on March 24, 2026.

2vulnerabilities
0critical
2high
0exploited
7.4average CVSS score

Latest Sbt vulnerabilities

  • 7.8 High severity

    sbt: Improper Neutralization of Special Elements used in an OS Command

    CVE-2026-32948Sbt

    sbt is a build tool for Scala, Java, and others. From version 0.9.5 to before version 1.12.7, on Windows, sbt uses Process("cmd", "/c", ...) to run VCS commands (git, hg, svn). The URI fragment (branch, tag, revision) is user-controlled via the build definitio

  • 7.1 High severity

    sbt: Improper Limitation of a Pathname to a Restricted Directory

    CVE-2023-46122Sbt

    sbt is a build tool for Scala, Java, and others. Given a specially crafted zip or JAR file, `IO.unzip` allows writing of arbitrary file. This would have potential to overwrite `/root/.ssh/authorized_keys`. Within sbt's main code, `IO.unzip` is used in `pullRem