Vulnerability · Published Oct 2, 2026 · Assigned by Meta
CVE-2026-104026
High 7.8
In plain English
A high-severity security flaw in Sapling SCM from Meta Platforms, Inc. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities).
Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.1%top 97.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
In Sapling SCM prior to v0.2.20260929-102736, control characters were allowed to be embedded in Git subtree URLs. A maliciously constructed repository, if cloned by a target, could trigger code execution on otherwise read-only actions such as sl log/blame/annotate.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Meta Platforms, Inc | Sapling SCM | v0.0.0 – before v0.2.20260929-102736 |
Weakness: CWE-150 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://www.facebook.com/security/advisories/cve-2026-104026 x_refsource_CONFIRM