<!-- mobian-agent-page publisher="dailydev" canonical="https://daily.dev/posts/fixing-a-command-injection-vulnerability-in-sbt-jjwubysgl" -->

---
title: Fixing a Command Injection Vulnerability in sbt | daily.dev
description: A command injection vulnerability (CVE-2026-32948, CVSS 6.7) was found in sbt's handling of source dependency URIs on Windows. sbt wrapped VCS commands (git,...
canonical: https://daily.dev/posts/fixing-a-command-injection-vulnerability-in-sbt-jjwubysgl
twitter:card: summary_large_image
twitter:site: @dailydotdev
og:type: website
og:site_name: daily.dev
og:title: Fixing a Command Injection Vulnerability in sbt | daily.dev
og:description: A command injection vulnerability (CVE-2026-32948, CVSS 6.7) was found in sbt's handling of source dependency URIs on Windows. sbt wrapped VCS commands (git,...
og:url: https://daily.dev/posts/fixing-a-command-injection-vulnerability-in-sbt-jjwubysgl
og:image: https://api.daily.dev/og/posts/jJwubYSGl.png
og:image:alt: Fixing a Command Injection Vulnerability in sbt
og:image:width: 1200
og:image:height: 630
og:locale: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Fixing a Command Injection Vulnerability in sbt

**[The Scala Programming Language](https://daily.dev/sources/scala-lang)** · 4 min read · 0 upvotes · 0 comments

## Summary

A command injection vulnerability (CVE-2026-32948, CVSS 6.7) was found in sbt's handling of source dependency URIs on Windows. sbt wrapped VCS commands (git, hg, svn) in cmd /c, allowing an attacker to embed shell metacharacters like && in a repository URI fragment to execute arbitrary commands, such as launching calc.exe. The bug existed since sbt 0.9.5 and affects sbt 1.x and 2.0 release candidates on Windows. The fix removes the cmd /c wrapper and adds an allowlist for URI fragment characters. Users should update to sbt 1.12.8 or sbt 2.0.0-RC10 or later and review any source dependency URIs for trustworthiness.

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://www.scala-lang.org/blog/2026/03/31/sbt-security-advisory.html>

## Questions this post answers

### What is CVE-2026-32948 in sbt and how does it work?

CVE-2026-32948 is a command injection vulnerability in sbt affecting Windows, rated Moderate with CVSS 6.7. sbt wrapped VCS commands (git, hg, svn) in cmd /c when resolving source dependencies, and since the URI fragment after # was passed unvalidated, an attacker could inject shell metacharacters like && to run arbitrary commands, for example appending %26%26calc.exe to a dependency URI to launch Calculator. The bug existed since sbt 0.9.5.

_Track build-tool CVEs like this one on daily.dev before they hit your Windows CI pipeline._

### How do I fix the sbt Windows command injection vulnerability?

Update project/build.properties to sbt 1.12.8 or later, or sbt 2.0.0-RC10 or later if using sbt 2. The fix removes the cmd /c wrapper around VCS commands so shell metacharacters in URI fragments are no longer interpreted, and adds an allowlist restricting URI fragments to alphanumeric characters plus -, _, ., /, and +. Also verify that any source dependency URIs point to trusted repositories.

_daily.dev helps developers stay on top of sbt security advisories before upgrading builds._

### Which versions of sbt are affected by the source dependency command injection bug?

The vulnerability affects sbt on Windows from sbt 0.9.5 onward, including both the sbt 1.x line and sbt 2.0 release candidates. It was fixed in sbt 1.12.8 and sbt 2.0.0-RC10. The issue only affects Windows because it relied on wrapping VCS commands in cmd /c, which is not used on other operating systems.

_Developers comparing sbt release branches for security fixes can follow updates on daily.dev._

## Similar posts on daily.dev

- [CVE-2026-22718: Command injection on user machine using VSCode extension for Spring CLI](https://daily.dev/posts/cve-2026-22718-command-injection-on-user-machine-using-vscode-extension-for-spring-cli-qah3dxopu) · Spring · 1 upvotes · 0 comments
- [Fixing a remote execution vulnerability in sbt](https://daily.dev/posts/fixing-a-remote-execution-vulnerability-in-sbt-mntofrttt) · The Scala Programming Language · 0 upvotes · 0 comments
- [Composer 2.9.6 Fixes Two Perforce Command Injection Vulnerabilities](https://daily.dev/posts/composer-2-9-6-fixes-two-perforce-command-injection-vulnerabilities-1cyx9zwzx) · Laravel News · 25 upvotes · 3 comments
- [Sandbox bypass flaws in Cursor IDE highlight prompt injection as an RCE vector](https://daily.dev/posts/sandbox-bypass-flaws-in-cursor-ide-highlight-prompt-injection-as-an-rce-vector-fnfy3vrj6) · CSO Online · 0 upvotes · 0 comments

---

Tags: [#security](https://daily.dev/tags/security), [#windows](https://daily.dev/tags/windows), [#scala](https://daily.dev/tags/scala)

[View this post on daily.dev](https://daily.dev/posts/fixing-a-command-injection-vulnerability-in-sbt-jjwubysgl)

```json
{"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]}
{"@context":"https://schema.org","@type":"TechArticle","headline":"Fixing a Command Injection Vulnerability in sbt","url":"https://daily.dev/posts/fixing-a-command-injection-vulnerability-in-sbt-jjwubysgl","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/fixing-a-command-injection-vulnerability-in-sbt-jjwubysgl"},"datePublished":"2026-08-23T12:17:17.721Z","dateModified":"2026-08-23T12:20:20.364Z","description":"A command injection vulnerability (CVE-2026-32948, CVSS 6.7) was found in sbt's handling of source dependency URIs on Windows. sbt wrapped VCS commands (git,...","image":"https://media.daily.dev/image/upload/s--ZrL_HSsR--/f_auto/v1722860399/public/Placeholder%2006","thumbnailUrl":"https://media.daily.dev/image/upload/s--ZrL_HSsR--/f_auto/v1722860399/public/Placeholder%2006","isAccessibleForFree":true,"articleSection":"The Scala Programming Language","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"The Scala Programming Language","logo":"https://media.daily.dev/image/upload/s--4Bql-UcX--/f_auto,q_auto/v1787487426/logos/scala-lang?_a=BAMAMicg0","url":"https://daily.dev/sources/scala-lang"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/fixing-a-command-injection-vulnerability-in-sbt-jjwubysgl","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,windows,scala","timeRequired":"PT4M"}
{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"The Scala Programming Language","item":"https://daily.dev/sources/scala-lang"},{"@type":"ListItem","position":3,"name":"Fixing a Command Injection Vulnerability in sbt"}]}
{"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/fixing-a-command-injection-vulnerability-in-sbt-jjwubysgl#faq","mainEntity":[{"@type":"Question","name":"What is CVE-2026-32948 in sbt and how does it work?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-32948 is a command injection vulnerability in sbt affecting Windows, rated Moderate with CVSS 6.7. sbt wrapped VCS commands (git, hg, svn) in cmd /c when resolving source dependencies, and since the URI fragment after # was passed unvalidated, an attacker could inject shell metacharacters like && to run arbitrary commands, for example appending %26%26calc.exe to a dependency URI to launch Calculator. The bug existed since sbt 0.9.5. Track build-tool CVEs like this one on daily.dev before they hit your Windows CI pipeline."}},{"@type":"Question","name":"How do I fix the sbt Windows command injection vulnerability?","acceptedAnswer":{"@type":"Answer","text":"Update project/build.properties to sbt 1.12.8 or later, or sbt 2.0.0-RC10 or later if using sbt 2. The fix removes the cmd /c wrapper around VCS commands so shell metacharacters in URI fragments are no longer interpreted, and adds an allowlist restricting URI fragments to alphanumeric characters plus -, _, ., /, and +. Also verify that any source dependency URIs point to trusted repositories. daily.dev helps developers stay on top of sbt security advisories before upgrading builds."}},{"@type":"Question","name":"Which versions of sbt are affected by the source dependency command injection bug?","acceptedAnswer":{"@type":"Answer","text":"The vulnerability affects sbt on Windows from sbt 0.9.5 onward, including both the sbt 1.x line and sbt 2.0 release candidates. It was fixed in sbt 1.12.8 and sbt 2.0.0-RC10. The issue only affects Windows because it relied on wrapping VCS commands in cmd /c, which is not used on other operating systems. Developers comparing sbt release branches for security fixes can follow updates on daily.dev."}}]}
```