CVE-2016-3105: Mercurial vulnerable to arbitrary code execution when converting Git repos
8.8
CVSS Score
3.0
Basic Information
CVE ID
GHSA ID
EPSS Score
0.67129%
CWE
Published
5/17/2022
Updated
9/30/2024
KEV Status
No
Technology
Python
Technical Details
CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| mercurial | pip | < 3.8 | 3.8 |
Vulnerability Intelligence
Miggo AI
Root Cause Analysis
The security patch modifies the init method of the convert_git class in hgext/convert/git.py to explicitly convert paths to absolute paths. This change addresses the core vulnerability where relative paths could be interpreted as Git URL formats (like 'ext::' protocol handlers), enabling command injection. The test cases demonstrate protection against repository names starting with 'ext::' which could execute shell commands. The vulnerable function is the entry point for git repository conversion handling.