sbt

sbt is an interactive build tool

Latest 2.1.0-RC1org.scala-sbt

88%

Total Score

healthy

Active project with frequent releases and broad contribution, but 25 of 26 workflow actions are unpinned and this is a release candidate.

Are you affected? Scan for Free

Health Score Breakdown

Security policy

The repository has no security policy, which reduces transparency for reporting and handling vulnerabilities even though Dependabot is enabled.

Version stability

This is a release candidate, so compatibility risk is higher than for a final release, although it is part of a stable major line and prereleases represent only 20% of recent releases.

Workflow audit

The audit covered all eight workflows with no untrusted checkouts, injection findings, or high-confidence audit issues. However, 25 of 26 action references are unpinned and two workflows have top-level write permissions, creating workflow hygiene and least-privilege concerns without an observed untrusted sink.

Vulnerabilities

Title	Versions	Severity
AIKIDO-2026-310773 sbt is vulnerable to Improper Authorization in versions 1.1.0 - 1.12.14 and 2.0.0 - 2.0.5.	1.1.0 - 1.12.142.0.0 - 2.0.5	Critical
CVE-2026-32948 org.scala-sbt:sbt is vulnerable to Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in versions 0.9.5 - 1.12.7.	0.9.5 - 1.12.7	Medium
CVE-2023-46122 org.scala-sbt:sbt is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in versions 0.3.4 - 1.9.7.	0.3.4 - 1.9.7	Low