A remote code execution vulnerability (GHSA-m2pw-22cj-jq4v) was found in sbt affecting builds that explicitly set serverConnectionType to TCP. The flaw, present since sbt 1.1.0, allowed attackers to bypass token authentication on certain LSP-like endpoints and execute arbitrary code via crafted JSON-RPC messages. The fix ships in sbt 1.12.15 and 2.0.6; affected users should upgrade or remove the serverConnectionType setting. The post also notes an AI model independently rediscovered the same bug during testing.
Questions this post answers
Is there a security vulnerability in sbt that allows remote code execution?
Yes, sbt has a remote code execution vulnerability (GHSA-m2pw-22cj-jq4v) affecting builds that explicitly set serverConnectionType to ConnectionType.Tcp. Several LSP-like endpoints lacked proper access control, letting an attacker craft a JSON-RPC message and execute arbitrary code. It has existed since sbt 1.1.0 and affects both sbt 1.x and 2.x. Track security advisories like this sbt fix as part of staying current on your build tooling with daily.dev.
How do I fix the sbt TCP remote code execution vulnerability?
Upgrade to sbt 1.12.15 or sbt 2.0.6 or later by setting sbt.version=1.12.15 in project/build.properties, or simply remove the serverConnectionType setting from the build entirely since only builds that explicitly configure TCP connections are affected. Note that installing a new sbt command does not change the sbt version an individual build actually uses. daily.dev helps developers keep pace with patch releases like this one before they bite in production.
Why is sbt's default UNIX domain socket or named pipe connection safer than TCP?
By default sbt uses UNIX domain sockets on Linux and macOS and named pipes on Windows, which are local-only communication channels. Switching to TCP via Global / serverConnectionType := ConnectionType.Tcp opens a deterministically calculable port (such as 5001) that remote attackers can reach and exploit, whereas the vulnerable endpoints lacked the token authentication normally required over TCP. Developers weighing config changes like this can follow the security trade-offs on daily.dev.