## Fixing a Command Injection Vulnerability in sbt

- 種別: release
- 関連技術: scala
- CVE: CVE-2026-32948
- 公開日時: 2026-03-30T22:00:00.000Z
- 情報源: Scala News (https://www.scala-lang.org/blog/2026/03/31/sbt-security-advisory.html)
- パーマリンク: https://vulnpulse.app/items/scala-22f4183b532b

This post covers work done under the Sovereign Tech Fund investment umbrella: sbt 2 Stable Release and Maintenance . The work is coordinated by the Scala Center . As part of our ongoing work on the sbt 2 release, we’ve been reviewing and hardening core parts of the sbt codebase. During that work, we discovered a command injection vulnerability in how sbt resolves source dependencies on Windows. The issue has been assigned CVE-2026-32948 , rated Moderate (CVSS 6.7), and is now fixed. If you use sbt on Windows, update to sbt 1.12.8 or sbt 2.0.0-RC10 or later to apply the fix. The vulnerability…