← Back

Scala Sbt

scala-sbt

1 CVE • 2 products

Products (2)

Click to collapse
Toggle
Io
io
1 CVE
Sbt
sbt
1 CVE

CVEs (1)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2023-46122
1Scala Sbt
2Io
Sbt
Jun 17, 2026
Oct 23, 2023
N/A· v4
7.1 HIGH· v3
N/A· v2
sbt is a build tool for Scala, Java, and others. Given a specially crafted zip or JAR file, `IO.unzip` allows writing of arbitrary file. This would have potential to overwrite `/root/.ssh/authorized_keys`. Within sbt's m...Show more
sbt is a build tool for Scala, Java, and others. Given a specially crafted zip or JAR file, `IO.unzip` allows writing of arbitrary file. This would have potential to overwrite `/root/.ssh/authorized_keys`. Within sbt's main code, `IO.unzip` is used in `pullRemoteCache` task and `Resolvers.remote`; however many projects use `IO.unzip(...)` directly to implement custom tasks. This vulnerability has been patched in version 1.9.7.Show less