sapling_scm vulnerabilities

CVEs whose affected-version data names the sapling_scm package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-104026High· 7.8

today

In Sapling SCM prior to v0.2.20260929-102736, control characters were allowed to be embedded in Git subtree URLs

In Sapling SCM prior to v0.2.20260929-102736, control characters were allowed to be embedded in Git subtree URLs. A maliciously constructed repository, if cloned by a target, could trigger code execution on otherwise read-only actions su…

▾ TwilightMeta Platforms, Inc · Sapling SCMvia NVD