Maven/org.scala-sbt:sbt CVE-2023-46122: low 3.9, EPSS 0.37%
sbt vulnerable to arbitrary file write via archive extraction (Zip Slip)
Action: Upgrade org.scala-sbt:sbt to 1.9.7 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0.3.4 | 1.9.7 | - |
Fixed versions
| 1.9.7 |
Sources
- osv: GHSA-h9mw-grgx-2fhf
- https://github.com/sbt/sbt/security/advisories/GHSA-h9mw-grgx-2fhf
- https://nvd.nist.gov/vuln/detail/CVE-2023-46122
- https://github.com/sbt/io/issues/358
- https://github.com/sbt/io/pull/360
- https://github.com/sbt/io/commit/124538348db0713c80793cb57b915f97ec13188a
- https://github.com/sbt/sbt
CVE-2023-46122 · published · modified · JSON