CVE-2023-46122

    Dashboard / Vulnerabilities / CVE-2023-46122

    CVE-2023-46122

    Published: 23 Oct 2023Last Modified: 28 Oct 2026

    Summary: Arbitrary file write via archive extraction (Zip Slip) vulnerability in sbt

    Details: sbt is a build tool for Scala, Java, and others. Given a specially crafted zip or JAR file, `IO.unzip` allows writing of arbitrary file. This would have potential to overwrite `/root/.ssh/authorized_keys`. Within sbt's main code, `IO.unzip` is used in `pullRemoteCache` task and `Resolvers.remote`; however many projects use `IO.unzip(...)` directly to implement custom tasks. This vulnerability has been patched in version 1.9.7.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/46xxx/CVE-2023-46122.json, https://github.com/sbt/sbt/security/advisories/GHSA-h9mw-grgx-2fhf, https://nvd.nist.gov/vuln/detail/CVE-2023-46122, https://github.com/sbt/io/issues/358, https://github.com/sbt/io/commit/124538348db0713c80793cb57b915f97ec13188a, https://github.com/sbt/io/pull/360

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 748d6c0de75b2ea8150666826ef11f1d546975bd
    Fixed -124538348db0713c80793cb57b915f97ec13188a

    Affected versions

    v1.9.1
    v1.9.0-RC3
    v1.9.0
    v1.9.0-M1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-46122 | CVE-DB