{"action":"Upgrade mercurial to 3.8-rc or later.","affected":[{"fixed":"3.8-rc","introduced":"0"}],"component":"mercurial","cve_ids":["CVE-2016-3105"],"ecosystem":"PyPI","epss":0.02751,"exploited":false,"fixed_versions":["3.8-rc"],"ghsa_id":"GHSA-49cw-434h-qc57","id":"tcs_01M5KG6W81AR5P2SW2F0HTXESF","modified_at":"2026-06-10T17:01:49.110424305Z","published_at":"2016-05-09T20:59:00Z","references":["https://osv.dev/vulnerability/PYSEC-2016-28","https://selenic.com/hg/rev/a56296f55a5e","https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_3.8_.2F_3.8.1_.282016-5-1.29","http://www.debian.org/security/2016/dsa-3570","http://www.securityfocus.com/bid/90536","http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.533255","http://lists.opensuse.org/opensuse-updates/2016-05/msg00082.html","https://security.gentoo.org/glsa/201612-19","https://github.com/advisories/GHSA-49cw-434h-qc57"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2016-28","url":"https://osv.dev/vulnerability/PYSEC-2016-28"}],"summary":"The convert extension in Mercurial before 3.8 might allow context-dependent attackers to execute arbitrary code via a crafted git repository name."}