Meta Platforms, Inc Sapling SCM
- CVE-2026-104026 In Sapling SCM prior to v0.2.20260929-102736, control characters were allowed to be embedded in Git subtree URLs. A maliciously constructed repository, if cloned by a target, could trigger code execut 0.1%