Sapling Scm
Monthly
Code execution in Sapling SCM versions prior to v0.2.20260929-102736 can be triggered by cloning a maliciously crafted Git repository whose subtree URLs contain embedded control characters; simply running an otherwise read-only command such as 'sl log', 'sl blame', or 'sl annotate' against that clone is enough to execute attacker-controlled code. Exploitation is not remote or automatic: the CVSS vector (AV:L/PR:N/UI:R) requires the victim to clone an untrusted repository and then invoke one of the affected commands, so an attacker must first socially engineer the clone. At time of analysis there is no public exploit identified, CISA SSVC records Exploitation as 'none', the issue is not in CISA KEV, and no EPSS signal was provided; nonetheless the potential technical impact is total (confidentiality, integrity, and availability all High), so patched installations (v0.2.20260929-102736 and later) should be treated as the only safe configuration.
Code execution in Sapling SCM versions prior to v0.2.20260929-102736 can be triggered by cloning a maliciously crafted Git repository whose subtree URLs contain embedded control characters; simply running an otherwise read-only command such as 'sl log', 'sl blame', or 'sl annotate' against that clone is enough to execute attacker-controlled code. Exploitation is not remote or automatic: the CVSS vector (AV:L/PR:N/UI:R) requires the victim to clone an untrusted repository and then invoke one of the affected commands, so an attacker must first socially engineer the clone. At time of analysis there is no public exploit identified, CISA SSVC records Exploitation as 'none', the issue is not in CISA KEV, and no EPSS signal was provided; nonetheless the potential technical impact is total (confidentiality, integrity, and availability all High), so patched installations (v0.2.20260929-102736 and later) should be treated as the only safe configuration.