CVE-2017-9462
High · 8.8CVSS
8.8
EPSS
21.7%
Published
Jun 6, 2017
CISA due date
—
The record
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and consequently execute arbitrary code, by using --debugger as a repository name.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| PyPI | mercurial | 0 | 4.1.3 |
| Debian:11 | mercurial | 0 | 4.3.1-1 |
| Debian:12 | mercurial | 0 | 4.3.1-1 |
| Debian:13 | mercurial | 0 | 4.3.1-1 |
| Debian:14 | mercurial | 0 | 4.3.1-1 |
| Debian:7 | mercurial | 0 | 2.2.2-4+deb7u4 |
| Debian:8 | mercurial | 0 | 3.1.2-2+deb8u5 |
| Mageia:5 | mercurial | 0 | 3.1.1-5.3.mga5 |
| Red Hat:enterprise_linux:6::client | emacs-mercurial | 0 | 0:1.4-5.el6_9 |
| Red Hat:enterprise_linux:6::client | emacs-mercurial-el | 0 | 0:1.4-5.el6_9 |
| Red Hat:enterprise_linux:6::client | mercurial | 0 | 0:1.4-5.el6_9 |
| Red Hat:enterprise_linux:6::client | mercurial-debuginfo | 0 | 0:1.4-5.el6_9 |
| Red Hat:enterprise_linux:6::client | mercurial-hgk | 0 | 0:1.4-5.el6_9 |
| Red Hat:enterprise_linux:6::computenode | emacs-mercurial | 0 | 0:1.4-5.el6_9 |
| Red Hat:enterprise_linux:6::computenode | emacs-mercurial-el | 0 | 0:1.4-5.el6_9 |
| Red Hat:enterprise_linux:6::computenode | mercurial | 0 | 0:1.4-5.el6_9 |
| Red Hat:enterprise_linux:6::computenode | mercurial-debuginfo | 0 | 0:1.4-5.el6_9 |
| Red Hat:enterprise_linux:6::computenode | mercurial-hgk | 0 | 0:1.4-5.el6_9 |
| Red Hat:enterprise_linux:6::server | emacs-mercurial | 0 | 0:1.4-5.el6_9 |
| Red Hat:enterprise_linux:6::server | emacs-mercurial-el | 0 | 0:1.4-5.el6_9 |
| Red Hat:enterprise_linux:6::server | mercurial | 0 | 0:1.4-5.el6_9 |
| Red Hat:enterprise_linux:6::server | mercurial-debuginfo | 0 | 0:1.4-5.el6_9 |
| Red Hat:enterprise_linux:6::server | mercurial-hgk | 0 | 0:1.4-5.el6_9 |
| Red Hat:enterprise_linux:6::workstation | emacs-mercurial | 0 | 0:1.4-5.el6_9 |
| Red Hat:enterprise_linux:6::workstation | emacs-mercurial-el | 0 | 0:1.4-5.el6_9 |
| Red Hat:enterprise_linux:6::workstation | mercurial | 0 | 0:1.4-5.el6_9 |
| Red Hat:enterprise_linux:6::workstation | mercurial-debuginfo | 0 | 0:1.4-5.el6_9 |
| Red Hat:enterprise_linux:6::workstation | mercurial-hgk | 0 | 0:1.4-5.el6_9 |
| Red Hat:enterprise_linux:7::client | emacs-mercurial | 0 | 0:2.6.2-7.el7_3 |
| Red Hat:enterprise_linux:7::client | emacs-mercurial-el | 0 | 0:2.6.2-7.el7_3 |
| Red Hat:enterprise_linux:7::client | mercurial | 0 | 0:2.6.2-7.el7_3 |
| Red Hat:enterprise_linux:7::client | mercurial-debuginfo | 0 | 0:2.6.2-7.el7_3 |
| Red Hat:enterprise_linux:7::client | mercurial-hgk | 0 | 0:2.6.2-7.el7_3 |
| Red Hat:enterprise_linux:7::computenode | emacs-mercurial | 0 | 0:2.6.2-7.el7_3 |
| Red Hat:enterprise_linux:7::computenode | emacs-mercurial-el | 0 | 0:2.6.2-7.el7_3 |
| Red Hat:enterprise_linux:7::computenode | mercurial | 0 | 0:2.6.2-7.el7_3 |
| Red Hat:enterprise_linux:7::computenode | mercurial-debuginfo | 0 | 0:2.6.2-7.el7_3 |
| Red Hat:enterprise_linux:7::computenode | mercurial-hgk | 0 | 0:2.6.2-7.el7_3 |
| Red Hat:enterprise_linux:7::server | emacs-mercurial | 0 | 0:2.6.2-7.el7_3 |
| Red Hat:enterprise_linux:7::server | emacs-mercurial-el | 0 | 0:2.6.2-7.el7_3 |
| Red Hat:enterprise_linux:7::server | mercurial | 0 | 0:2.6.2-7.el7_3 |
| Red Hat:enterprise_linux:7::server | mercurial-debuginfo | 0 | 0:2.6.2-7.el7_3 |
| Red Hat:enterprise_linux:7::server | mercurial-hgk | 0 | 0:2.6.2-7.el7_3 |
| Red Hat:enterprise_linux:7::workstation | emacs-mercurial | 0 | 0:2.6.2-7.el7_3 |
| Red Hat:enterprise_linux:7::workstation | emacs-mercurial-el | 0 | 0:2.6.2-7.el7_3 |
| Red Hat:enterprise_linux:7::workstation | mercurial | 0 | 0:2.6.2-7.el7_3 |
| Red Hat:enterprise_linux:7::workstation | mercurial-debuginfo | 0 | 0:2.6.2-7.el7_3 |
| Red Hat:enterprise_linux:7::workstation | mercurial-hgk | 0 | 0:2.6.2-7.el7_3 |
| SUSE:Linux Enterprise Software Development Kit 11 SP4 | mercurial | 0 | 2.3.2-0.17.1 |
| SUSE:Linux Enterprise Software Development Kit 12 SP2 | mercurial | 0 | 2.8.2-14.1 |
| Ubuntu:14.04:LTS | mercurial | 0 | 2.8.2-1ubuntu1.4 |
| Ubuntu:16.04:LTS | mercurial | 0 | 3.7.3-1ubuntu1.1 |
Related vulnerabilities
- CVE-2014-9390 Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x… Also affects mercurial
- CVE-2026-102282 adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. CWE-732
- CVE-2026-92941 vm2 versions from 3.11.3 before 3.11.7 expose the host tls module to NodeVM sandbox code… CWE-732
- CVE-2026-87988 An arbitrary file access vulnerability in Mistral Vibe allows an attacker to bypass… CWE-732
- CVE-2026-19583 Velociraptor allows some sensitive artifacts to be gated by additional permissions. CWE-732
- CVE-2026-79617 Incorrect Permission Assignment for Critical Resource vulnerability in TÜBİTAK BİLGEM… CWE-732
- CVE-2026-82312 OpenVPN 2.0.0 through 2.6.22 and 2.7_alpha1 through 2.7.6 on Windows allows local… CWE-732
- CVE-2026-80112 PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and… CWE-732