{"id":"scala-22f4183b532b","seq":2897,"kind":"release","title":"Fixing a Command Injection Vulnerability in sbt","url":"https://www.scala-lang.org/blog/2026/03/31/sbt-security-advisory.html","permalink":"https://vulnpulse.app/items/scala-22f4183b532b","summary":"This post covers work done under the Sovereign Tech Fund investment umbrella: sbt 2 Stable Release and Maintenance . The work is coordinated by the Scala Center . As part of our ongoing work on the sbt 2 release, we’ve been reviewing and hardening core parts of the sbt codebase. During that work, we discovered a command injection vulnerability in how sbt resolves source dependencies on Windows. The issue has been assigned CVE-2026-32948 , rated Moderate (CVSS 6.7), and is now fixed. If you use sbt on Windows, update to sbt 1.12.8 or sbt 2.0.0-RC10 or later to apply the fix. The vulnerability…","severity":null,"techs":["scala"],"cves":["CVE-2026-32948"],"tags":["security"],"source":{"id":"scala","name":"Scala News"},"published_at":"2026-03-30T22:00:00.000Z","fetched_at":"2026-10-21T16:17:48.018Z"}