Fixing a Command Injection Vulnerability in sbt

This post covers work done under the Sovereign Tech Fund investment umbrella: sbt 2 Stable Release and Maintenance . The work is coordinated by the Scala Center . As part of our ongoing work on the sbt 2 release, we’ve been reviewing and hardening core parts of the sbt codebase. During that work, we discovered a command injection vulnerability in how sbt resolves source dependencies on Windows. The issue has been assigned CVE-2026-32948 , rated Moderate (CVSS 6.7), and is now fixed. If you use sbt on Windows, update to sbt 1.12.8 or sbt 2.0.0-RC10 or later to apply the fix. The vulnerability…

Scala Newsで読む