CVE-2026-104026 — Meta Platforms, Inc / Sapling SCM

CVE-2026-104026

Meta Platforms, Inc / Sapling SCM PUBLISHED

Description (CNA)

In Sapling SCM prior to v0.2.20260929-102736, control characters were allowed to be embedded in Git subtree URLs. A maliciously constructed repository, if cloned by a target, could trigger code execution on otherwise read-only actions such as sl log/blame/annotate.

Affected (CNA)

Vendor / product	Versions
Meta Platforms, Inc / Sapling SCM	affected v0.0.0 before v0.2.20260929-102736

CWE

No CWE identifiers supplied.

References

https://www.facebook.com/security/advisories/cve-2026-104026

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.