[ CVE-2026-104026 · Published 2 Oct 2026 ]
Vulnerability in Meta Platforms, Inc Sapling SCM
CVSS 7.8
EPSS <1%No fix listed yet
[ Description ]Official description
In Sapling SCM prior to v0.2.20260929-102736, control characters were allowed to be embedded in Git subtree URLs. A maliciously constructed repository, if cloned by a target, could trigger code execution on otherwise read-only actions such as sl log/blame/annotate.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.