Mercurial vulnerable to arbitrary code execution when converting Git repos

Published 10 y ago 2016-05-09 · modified 4 mo ago 2026-06-17 · JSON

CVSS

8.8

v3.0 · NVD

CISA KEV

not known exploited

EPSS

2.8%

percentile 86%

Public exploits

none known

The convert extension in Mercurial before 3.8 might allow context-dependent attackers to execute arbitrary code via a crafted git repository name.

Exploit prediction (EPSS)

2.75% probability of exploitation in the next 30 days, higher than 86% of all scored CVEs.

Assigned by	Version	Score	Vector
NVD	3.0	8.8	`CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`
NVD	2.0	6.8	`AV:N/AC:M/Au:N/C:P/I:P/A:P`
GitHub	3.0	8.8	`CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`

Ecosystem	Package	Affected	Fixed in
pypi	`mercurial`	<3.8 <3.8-rc	3.8 3.8-rc

Weakness

security.gentoo.org /glsa/201612-19 · vendor-advisory, x_refsource_GENTOO, x_transferred
securityfocus.com /bid/90536 · vdb-entry, x_refsource_BID, x_transferred
selenic.com /hg/rev/a56296f55a5e · x_refsource_CONFIRM, x_transferred
lists.opensuse.org /opensuse-updates/2016-05/msg00082.html · vendor-advisory, x_refsource_SUSE, x_transferred
slackware.com /security/viewer.php?l=slackware-security&y=2016&m=slackware-security.533255 · vendor-advisory, x_refsource_SLACKWARE, x_transferred
mercurial-scm.org /wiki/WhatsNew#Mercurial_3.8_.2F_3.8.1_.282016-5-1.29 · x_refsource_CONFIRM, x_transferred
debian.org /security/2016/dsa-3570 · vendor-advisory, x_refsource_DEBIAN, x_transferred
nvd.nist.gov /vuln/detail/CVE-2016-3105 · advisory
github.com /pypa/advisory-database/tree/main/vulns/mercurial/PYSEC-2016-28.yaml · web
web.archive.org /web/20200228012056/http://www.securityfocus.com/bid/90536 · web
github.com /advisories/GHSA-49cw-434h-qc57 · advisory

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.