Nixpkgs security tracker
Activity log
- Created suggestion
sbt: Source dependency feature (via crafted VCS URL) leads to arbitrary code execution on Windows
sbt is a build tool for Scala, Java, and others. From version 0.9.5 to before version 1.12.7, on Windows, sbt uses Process("cmd", "/c", ...) to run VCS commands (git, hg, svn). The URI fragment (branch, tag, revision) is user-controlled via the build definition and passed to these commands without validation. Because cmd /c interprets &, |, and ; as command separators, a malicious fragment can execute arbitrary commands. This issue has been patched in version 1.12.7.
References
-
https://github.com/sbt/sbt/security/advisories/GHSA-x4ff-q6h8-v7gw x_refsource_CONFIRM
-
https://github.com/sbt/sbt/releases/tag/v1.12.7 x_refsource_MISC
Affected products
- ==>= 0.9.5, < 1.12.7
Matching in nixpkgs
pkgs.sbt
Build tool for Scala, Java and more
pkgs.usbtop
Top utility that shows an estimated instantaneous bandwidth on USB buses and devices
pkgs.usbtree
Live USB device tree in your terminal. Rust TUI, no root, no libusb. Full activity metrics on Linux; device tree on macOS/Windows
-
nixos-unstable -
- nixos-unstable-small 0.1.1
pkgs.sbt-extras
More featureful runner for sbt, the simple/scala/standard build tool
-
nixos-unstable -
- nixos-unstable-small 2026-05-04
-
nixos-26.05 -
- nixos-26.05-small 2025-08-25
pkgs.simpleBuildTool
Build tool for Scala, Java and more
pkgs.sbt-with-scala-native
Build tool for Scala, Java and more, with the Scala Native toolchain
pkgs.python313Packages.usbtmc
Python implementation of the USBTMC instrument control protocol
pkgs.python314Packages.usbtmc
Python implementation of the USBTMC instrument control protocol
Package maintainers
-
@bjornfor Bjørn Forsman <bjorn.forsman@gmail.com>
-
@agilesteel Vladyslav Pekker <agilesteel@gmail.com>
-
@kashw2 Keanu Ashwell <supra4keanu@hotmail.com>
-
@puffnfresh Brian McKenna <brian@brianmckenna.org>
-
@djacu Daniel Baker <daniel.n.baker@gmail.com>