Description

In Sapling SCM prior to v0.2.20260929-102736, control characters were allowed to be embedded in Git subtree URLs. A maliciously constructed repository, if cloned by a target, could trigger code execution on otherwise read-only actions such as sl log/blame/annotate.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-10-02T15:17:05.453Z",
  "pubdate": "2026-10-02T15:17:05.453Z",
  "executiveSummary": "Sapling SCM versions prior to v0.2.20260929-102736 contain a critical vulnerability involving improper validation of Git subtree URLs. The application fails to sanitize input, allowing for the injection of control characters within repository configuration settings.\nThis flaw enables an attacker to manipulate the execution context of seemingly benign, read-only operations such as log, blame, and annotate. By embedding malicious command sequences into the Git subtree URL, a remote attacker can achieve arbitrary code execution on a victim's machine upon cloning or interacting with a specifically crafted repository.\nThe vulnerability represents a high-risk security flaw because it weaponizes standard source control operations. Exploitation does not require elevated administrative privileges or complex network-based exploits; it relies primarily on the victim performing a standard clone or metadata retrieval operation on a malicious repository. Successful exploitation leads to full local code execution under the security context of the user running the Sapling client, potentially facilitating data exfiltration, local system compromise, or lateral movement within a development environment.",
  "technicalDetails": "The vulnerability originates from the lack of strict sanitization and validation of Git subtree URLs within the Sapling SCM codebase. In the affected versions, the input handling mechanism for subtree configurations permits the inclusion of shell metacharacters and control characters within the URL string parameters.\nWhen a user performs operations like 'sl log', 'sl blame', or 'sl annotate', the underlying implementation invokes Git-related subprocesses to fetch or parse repository history. Because the subtree URL is passed directly to these execution streams without sufficient escaping, the shell or the invoked Git process interprets the embedded control characters as command delimiters or arguments.\nThe attack flow follows a structured progression: First, an attacker creates a malicious repository containing a specially crafted configuration file where the subtree URL includes shell-injected payloads. Second, the attacker induces a target user to clone this repository or invoke a metadata-fetching command against it using Sapling SCM. Third, as Sapling SCM attempts to resolve the subtree information to satisfy the requested read-only command, the embedded payload is passed to the system shell or underlying command-line interface. Finally, the payload executes with the privileges of the local user.\nThis injection vector is particularly dangerous because 'sl log' and 'sl blame' are considered standard, low-risk diagnostic tasks. Users typically do not expect these commands to trigger arbitrary logic. The vulnerability effectively turns passive repository browsing into an active exploit vector. The specific constraint on affected versions (prior to v0.2.20260929-102736) indicates a flaw in the input sanitization logic that failed to account for shell injection via URL-based configuration fields. The exploitation does not require the attacker to have prior authentication to the victim's local system, relying solely on the victim interacting with the malicious Git source. Post-exploitation impact includes the ability for the attacker to execute arbitrary binaries, access local environment variables, steal development credentials stored on the filesystem, or install persistence mechanisms, all while bypassing intended application-level restrictions for read-only repository operations."
}