CVE-2023-46122

sbt is a build tool for Scala, Java, and others. Given a specially crafted zip or JAR file, `IO.unzip` allows writing of arbitrary file. This would have potential to overwrite `/root/.ssh/authorized_keys`. Within sbt's main code, `IO.unzip` is used in `pullRemoteCache` task and `Resolvers.remote`; however many projects use `IO.unzip(...)` directly to implement custom tasks. This vulnerability has been patched in version 1.9.7.

• CWE-22
• CWE-22

• https://github.com/sbt/io/commit/124538348db0713c80793cb57b915f97ec13188aPatch
• https://github.com/sbt/io/issues/358Issue Tracking, Patch
• https://github.com/sbt/io/pull/360Patch
• https://github.com/sbt/sbt/security/advisories/GHSA-h9mw-grgx-2fhfExploit, Patch, Third Party Advisory
• https://github.com/sbt/io/commit/124538348db0713c80793cb57b915f97ec13188aPatch
• https://github.com/sbt/io/issues/358Issue Tracking, Patch
• https://github.com/sbt/io/pull/360Patch
• https://github.com/sbt/sbt/security/advisories/GHSA-h9mw-grgx-2fhfExploit, Patch, Third Party Advisory

Published

Oct 23, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-46117reconFTW is a tool designed to perform automated recon on a …8.8
• CVE-2023-46118RabbitMQ is a multi-protocol messaging and streaming broker.…4.9
• CVE-2023-46119Parse Server is an open source backend that can be deployed …7.5
• CVE-2023-4612Improper Authentication vulnerability in Apereo CAS in jakar…9.8
• CVE-2023-46120The RabbitMQ Java client library allows Java and JVM-based a…7.5
• CVE-2023-46121yt-dlp is a youtube-dl fork with additional features and fix…3.7
• CVE-2023-46123jumpserver is an open source bastion machine, professional o…5.3
• CVE-2023-46124Fides is an open-source privacy engineering platform for man…7.2
• CVE-2023-46125Fides is an open-source privacy engineering platform for man…6.5
• CVE-2023-46126Fides is an open-source privacy engineering platform for man…5.4
• CVE-2023-46127Frappe is a full-stack web application framework that uses P…5.4
• CVE-2023-46128Nautobot is a Network Automation Platform built as a web app…6.5