CVE-2023-46122

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

sbt is a build tool for Scala, Java, and others. Given a specially crafted zip or JAR file, `IO.unzip` allows writing of arbitrary file. This would have potential to overwrite `/root/.ssh/authorized_keys`. Within sbt's main code, `IO.unzip` is used in `pullRemoteCache` task and `Resolvers.remote`; however many projects use `IO.unzip(...)` directly to implement custom tasks. This vulnerability has been patched in version 1.9.7.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
sbt	sbt	>= 0.3.4, < 1.9.7

References

https://github.com/sbt/io/commit/124538348db0713c80793cb57b915f97ec13188aPatch
https://github.com/sbt/io/issues/358Issue Tracking, Patch
https://github.com/sbt/io/pull/360Patch
https://github.com/sbt/sbt/security/advisories/GHSA-h9mw-grgx-2fhfExploit, Patch, Third Party Advisory
https://github.com/sbt/io/commit/124538348db0713c80793cb57b915f97ec13188aPatch
https://github.com/sbt/io/issues/358Issue Tracking, Patch
https://github.com/sbt/io/pull/360Patch
https://github.com/sbt/sbt/security/advisories/GHSA-h9mw-grgx-2fhfExploit, Patch, Third Party Advisory

Timeline

Published: Oct 23, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-461235.3jumpserver is an open source bastion machine, professional operation and maintenance security audit system that complies with 4A specificati CVE-2023-461247.2Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in runtime environments, and the CVE-2023-461256.5Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in a runtime environment, and the CVE-2023-461265.4Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in runtime environments, helping CVE-2023-461275.4Frappe is a full-stack web application framework that uses Python and MariaDB on the server side and an integrated client side library. A ma CVE-2023-461286.5Nautobot is a Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL database. I CVE-2023-461297.5NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge compu CVE-2023-46139.8This vulnerability allows remote attackers to execute arbitrary code on affected installations of LG LED Assistant. Authentication is not re CVE-2023-461305.4Discourse is an open source platform for community discussion. Prior to version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the CVE-2023-461317.5Grails is a framework used to build web applications with the Groovy programming language. A specially crafted web request can lead to a JVM CVE-2023-461326.5Hyperledger Fabric is an open source permissioned distributed ledger framework. Combining two molecules to one another, called "cross-linkin CVE-2023-461339.1CryptoES is a cryptography algorithms library compatible with ES6 and TypeScript. Prior to version 2.1.0, CryptoES PBKDF2 is 1,000 times wea