AIKIDO-2026-824110

main_3 is vulnerable to Remote Code Execution

Remote Code ExecutionGHSA-m2pw-22cj-jq4v Published Aug 11, 2026

Critical Risk

This Affects:

main_3

2.0.0 - 2.0.5

Fixed in 2.0.6

Are you affected? Scan for Free

TL;DR

sbt runs a build server that accepts Language Server Protocol JSON-RPC requests, and it can be configured to listen over TCP by setting serverConnectionType to Tcp. The sbt/exec request handler does not require a completed token-authenticated initialize handshake before acting, so it unconditionally queues the supplied command line for execution. A client that can reach the TCP socket can submit an arbitrary commandLine and have sbt evaluate it without knowing the authentication token. The fix gates the Language Server Protocol calls such as sbt/exec behind successful authentication.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and you configure the sbt server to use TCP by setting serverConnectionType to Tcp.