Mercurial vulnerable to arbitrary command execution via a crafted repository name in a clone command
High severity
GitHub Reviewed
Published
May 14, 2022
to the GitHub Advisory Database
•
Updated May 1, 2024
Description
Published by the National Vulnerability Database
Mar 31, 2015
Published to the GitHub Advisory Database
May 14, 2022
Reviewed
May 1, 2024
Last updated
May 1, 2024
The _validaterepo function in sshpeer in Mercurial before 3.2.4 allows remote attackers to execute arbitrary commands via a crafted repository name in a clone command.
References