CVE-2026-32948: 
Java vulnerability analysis and mitigation

CVE-2026-32948 is an OS command injection vulnerability in sbt (a build tool for Scala, Java, and others) that allows arbitrary command execution on Windows systems via crafted VCS dependency URIs. It affects sbt versions from 0.9.5 up to (but not including) 1.12.7, and was discovered by Anatolii Kmetyuk at Scala Center and disclosed on March 24, 2026. The vulnerability carries a CVSS v3.1 base score of 7.8 (High) and a CVSS v4.0 base score of 6.7 (Medium) (Github Advisory, sbt Security Advisory).

The root cause is improper neutralization of special elements in an OS command (CWE-78). On Windows, sbt's Resolvers.scala uses Process("cmd", "/c", ...) to invoke VCS tools (git, hg, svn), and the URI fragment (branch, tag, or revision) is extracted via uri.getFragment() and passed directly to this command without any sanitization. Because cmd /c interprets &, |, and ; as command separators, a malicious URI fragment such as develop&&calc.exe (URL-encoded as develop%26%26calc.exe) causes the Windows command shell to execute the injected command. The vulnerable code paths are in Resolvers.scala at lines 84–95 (git resolver) and 137–145 (the run() method), and the flaw affects all three supported VCS backends (git, Mercurial, Subversion) (sbt Security Advisory, Patch Commit).

Successful exploitation allows an attacker who controls the dependency URI in a build definition to execute arbitrary Windows commands with the privileges of the user running the sbt build. This can result in full compromise of the developer's workstation, including data exfiltration, installation of malware, or lateral movement within a development environment. The impact is limited to Windows systems; Linux and macOS users are not affected because those platforms do not use cmd /c for process invocation (sbt Security Advisory, Github Advisory).

1. Craft a malicious build definition: Create or modify a build.sbt file to include a source dependency with a crafted VCS URI containing a command separator in the fragment, e.g.:

lazy val vulnerable = RootProject(
  uri("https://github.com/sbt/io.git#develop%26%26calc.exe")
)

2. Deliver the malicious build file: Distribute the malicious build.sbt (and optionally build.properties pinning a vulnerable sbt version such as sbt.version=1.12.5) to a target Windows developer via a shared repository, pull request, or social engineering.
3. Trigger the build: Wait for the victim to run sbt in the project directory. sbt will attempt to resolve the source dependency and invoke the git resolver.
4. Command injection executes: The git resolver calls Process("cmd", "/c", "git", "clone", ..., "develop&&calc.exe"). Windows cmd /c interprets && as a command separator and executes calc.exe (or any attacker-chosen command) with the privileges of the user running sbt.
5. Achieve objective: Replace calc.exe with a reverse shell, data exfiltration script, or persistence mechanism to fully compromise the developer's workstation (sbt Security Advisory, Github Advisory).

• Process: Unexpected child processes spawned by the sbt Java process on Windows, such as cmd.exe, powershell.exe, calc.exe, or other executables not normally associated with a build tool; cmd.exe invocations with /c flags containing &&, |, or ; in the argument string.
• Logs: Windows Event Logs (Security, Event ID 4688) showing process creation events where cmd.exe is a child of the sbt Java process with suspicious command-line arguments containing shell metacharacters.
• Network: Unexpected outbound network connections from the sbt process or its child processes to unknown external hosts, particularly during the dependency resolution phase of a build.
• File System: Unexpected files created in the project directory or user's temp directory during an sbt build; new scheduled tasks, startup entries, or scripts written by the sbt process user account.

The primary remediation is to upgrade sbt to version 1.12.8 or later. Note that sbt 1.12.7 contains the security fix but has a separate bug that makes source dependencies non-functional, so 1.12.8 is the recommended minimum patched version. The fix replaces the cmd /c-based process invocation with a direct Process(argv) call that bypasses shell interpretation, and adds a VcsUriFragment.validate() function that rejects fragments containing shell metacharacters (&, |, ;) and control characters, using an allowlist of safe characters (ASCII letters, digits, and -, _, ., /, +). As a workaround, avoid running sbt builds from untrusted or unreviewed build definition files, and restrict write access to build.sbt and build.properties to trusted developers only (Github Advisory, sbt Release v1.12.7, Patch Commit).

The vulnerability was discovered by Anatolii Kmetyuk at Scala Center and responsibly disclosed to the sbt maintainer Eugene Yokota (eed3si9n), who published the advisory and patch on March 24, 2026. The Scala language blog published a security advisory post on March 31, 2026, and the official sbt Bluesky account announced the release. The Scala community forum and Reddit's r/scala discussed the release, with the community generally responding positively to the prompt patch and clear disclosure (Scala Blog, sbt Release v1.12.7).