PT-2026-2489 · Mercurial+3 · Mercurial+3
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Go (affected versions not specified)
Description
A flaw exists where downloading and building modules with malicious version strings can lead to local code execution. Systems utilizing Mercurial (hg) are susceptible to unexpected code execution when downloading modules from non-standard sources, stemming from the construction of external VCS commands. This issue can also be triggered by supplying malicious version strings directly to the toolchain. On systems with Git installed, malicious version strings can enable an attacker to write to arbitrary files on the filesystem, but this requires explicitly providing the malicious strings and does not impact usage of
@latest or bare module paths. The issue relates to unexpected code execution when invoking the toolchain.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
DoS
Memory Corruption
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Git
Go
Mercurial
Red Os