Mercurial vulnerable to arbitrary code execution via a crafted name when converting a Git repository

ALTO 8.8CVE-2016-3069 · GHSA-8fm8-7365-5rh2 · PYSEC-2016-27 · Published 13/04/2016 · updated 17/06/2026

En resumen

CVE-2016-3069 es una vulnerabilidad ALTO (CVSS 8.8) que afecta a mercurial, mercurial (mercurial), linux enterprise debuginfo (suse).
Probabilidad de explotación en los próximos 30 días (EPSS): 5.0%, mayor que el 92.2% de las vulnerabilidades.
Solución: actualizar a 3.7.3 o posterior.

Package	Affected versions	Patched versions
mercurial PyPI	`< 3.7.3`	`3.7.3`
mercurial mercurial	`≤ 3.7.2`	No fix yet
linux enterprise debuginfo suse	`= 11`	No fix yet

Mercurial before 3.7.3 allows remote attackers to execute arbitrary code via a crafted name when converting a Git repository.

NVD description

Mercurial before 3.7.3 allows remote attackers to execute arbitrary code via a crafted name when converting a Git repository.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.