Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

mercurial

18 known vulnerabilities (1 medium), with the versions each affects and the releases that fix them.

Latest release
7.2.4 (Aug 11, 2026): no advisory affects it
Newest unaffected release
7.2.4 (Aug 11, 2026), the latest release
Advisories
18 · 1 medium
Weekly downloads
56.9K
Dependents
18
Releases
212 since 2.6.2 (Jul 16, 2013)
Registry
PyPI
Releases read
Nov 8, 2026

Version timeline

Show all 18 advisoriesShow fewer advisories
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 18

  • Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial…

    Affected: fixed in 3.2.3.

    Fixed in 3.2.3 (released Dec 18, 2014, 1882 days before disclosure).

    The latest release, 7.2.4, is not affected.

  • Mercurial before 1.6.4 fails to verify the Common Name field of SSL certificates which allows remote attackers who acquire a certificate…

    Affected: fixed in 1.6.4.

    Fixed in 2.6.2 (released Jul 16, 2013, 2296 days before disclosure, the advisory names 1.6.4, which was never published).

    The latest release, 7.2.4, is not affected.

  • CVE-2019-3902Medium 5.1

    A flaw was found in Mercurial before 4.9.

    Affected: fixed in 4.9.

    Fixed in 4.9.0 (released Feb 1, 2019, 80 days before disclosure).

    The latest release, 7.2.4, is not affected.

  • cext/manifest.c in Mercurial before 4.7.2 has an out-of-bounds read during parsing of a malformed manifest entry.

    Affected: fixed in 4.7.2.

    Fixed in 4.7.2 (released Oct 1, 2018, 3 days before disclosure).

    The latest release, 7.2.4, is not affected.

  • The mpatch_decode function in mpatch.c in Mercurial before 4.6.1 mishandles certain situations where there should be at least 12 bytes…

    Affected: fixed in 4.6.1.

    Fixed in 4.6.1 (released Jun 6, 2018, 30 days before disclosure).

    The latest release, 7.2.4, is not affected.

  • mpatch.c in Mercurial before 4.6.1 mishandles integer addition and subtraction, aka OVE-20180430-0002.

    Affected: fixed in 4.6.1.

    Fixed in 4.6.1 (released Jun 6, 2018, 30 days before disclosure).

    The latest release, 7.2.4, is not affected.

  • The mpatch_apply function in mpatch.c in Mercurial before 4.6.1 incorrectly proceeds in cases where the fragment start is past the end of…

    Affected: fixed in 4.6.1.

    Fixed in 4.6.1 (released Jun 6, 2018, 30 days before disclosure).

    The latest release, 7.2.4, is not affected.

  • Mercurial version 4.5 and earlier contains a Incorrect Access Control (CWE-285) vulnerability in Protocol server that can result in…

    Affected: fixed in 4.5.1.

    Fixed in 4.5.1 (released Mar 6, 2018, 8 days before disclosure).

    The latest release, 7.2.4, is not affected.

  • In Mercurial before 4.4.1, it is possible that a specially malformed repository can cause Git subrepositories to run arbitrary code in the…

    Affected: fixed in 4.4.1.

    Fixed in 4.4.1 (released Nov 7, 2017, 30 days before disclosure).

    The latest release, 7.2.4, is not affected.

  • Mercurial prior to 4.3 did not adequately sanitize hostnames passed to ssh, leading to possible shell-injection attacks.

    Affected: fixed in 4.3.

    Fixed in 4.3.0 (released Aug 10, 2017, 55 days before disclosure).

    The latest release, 7.2.4, is not affected.

  • Mercurial prior to version 4.3 is vulnerable to a missing symlink check that can malicious repositories to modify files outside the…

    Affected: fixed in 4.3; fixed in 4.3.1.

    Fixed in 4.3.1 (released Aug 10, 2017, 55 days before disclosure).

    The latest release, 7.2.4, is not affected.

  • In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and consequently execute…

    Affected: fixed in 4.1.3.

    Fixed in 4.1.3 (released Apr 18, 2017, 49 days before disclosure).

    The latest release, 7.2.4, is not affected.

  • The convert extension in Mercurial before 3.8 might allow context-dependent attackers to execute arbitrary code via a crafted git…

    Affected: fixed in 3.8; fixed in 3.8-rc.

    Fixed in 3.8.0 (released May 1, 2016, 8 days before disclosure).

    The latest release, 7.2.4, is not affected.

  • The binary delta decoder in Mercurial before 3.7.3 allows remote attackers to execute arbitrary code via a (1) clone, (2) push, or (3)…

    Affected: fixed in 3.7.3.

    Fixed in 3.7.3 (released Mar 29, 2016, 15 days before disclosure).

    The latest release, 7.2.4, is not affected.

  • Mercurial before 3.7.3 allows remote attackers to execute arbitrary code via a crafted name when converting a Git repository.

    Affected: fixed in 3.7.3.

    Fixed in 3.7.3 (released Mar 29, 2016, 15 days before disclosure).

    The latest release, 7.2.4, is not affected.

Show all 18 advisoriesShow fewer advisories

  • Mercurial before 3.7.3 allows remote attackers to execute arbitrary code via a crafted git ext:: URL when cloning a subrepository.

    Affected: fixed in 3.7.3.

    Fixed in 3.7.3 (released Mar 29, 2016, 15 days before disclosure).

    The latest release, 7.2.4, is not affected.

  • The _validaterepo function in sshpeer in Mercurial before 3.2.4 allows remote attackers to execute arbitrary commands via a crafted…

    Affected: fixed in 3.2.4.

    Fixed in 3.2.4 (released Jan 1, 2015, 89 days before disclosure).

    The latest release, 7.2.4, is not affected.

  • Directory traversal vulnerability in patch.py in Mercurial 1.0.1 allows user-assisted attackers to modify arbitrary files via ".." (dot…

    Affected: fixed in 1.0.2.

    Fixed in 2.6.2 (released Jul 16, 2013, 1842 days after disclosure, the advisory names 1.0.2, which was never published).

    The latest release, 7.2.4, is not affected.