SBT, the Scala build tool, was found to execute VCS commands using the Windows command interpreter. When a build definition includes a VCS URL, the fragment part of that URL (branch, tag, or revision information) is inserted directly into a cmd /c command string without validation. The command interpreter treats characters such as &, |, and ; as command separators, allowing a crafted fragment to inject arbitrary shell commands. This permits an attacker who can influence the build definition to execute any command with the permissions of the sbt process, potentially compromising the entire build environment. The weakness is a classic command injection flaw (CWE-78).

The vulnerability affects SBT versions from 0.9.5 up to, but not including, 1.12.7 on Windows platforms. Any Windows installations running these older SBT versions and processing build files that reference source dependencies via VCS URLs are at risk.

The CVSS score is 6.7, indicating moderate severity, while the EPSS score is reported as less than 1 %, suggesting a low probability of exploitation in the wild. The flaw is not listed in CISA’s KEV catalog. Because sbt runs on the local machine during build time, the attack vector is local or user‑provided, with the attacker needing to supply a malicious build definition or a compromised source dependency URL. If an attacker can deliver such a build file, they could gain full control of the sbt process on a Windows machine.