What is CVE-2026-104026?

CVE-2026-104026 is a high-severity vulnerability in Meta Platforms, Inc Sapling Scm, classified under CWE-150. CVSS score: 7.8/10. Published 2026-10-02.

How severe is CVE-2026-104026?

High severity. CVSS v3 base score is 7.8 out of 10.

Vulnerability in Meta Platforms, Inc Sapling Scm

CVE-2026-104026

In Sapling SCM prior to v0.2.20260929-102736, control characters were allowed to be embedded in Git subtree URLs. A maliciously constructed repository, if cloned by a target, could trigger code execution on otherwise read-only actions such as sl log/blame/annotate.

Published 2026-10-02 · last modified 2026-10-02.

CVSS v3 metric

CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

Meta Platforms, Inc Sapling Scm

Weakness classification (CWE)

CWE-150

References

www.facebook.com/security/advisories/cve-2026-104026

Frequently asked questions

What is CVE-2026-104026?: CVE-2026-104026 is a high-severity vulnerability in Meta Platforms, Inc Sapling Scm, classified under CWE-150. CVSS score: 7.8/10. Published 2026-10-02.
How severe is CVE-2026-104026?: High severity. CVSS v3 base score is 7.8 out of 10.