# mercurial (PyPI) vulnerabilities 18 known vulnerabilities (1 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 7.2.4 (Aug 11, 2026): no advisory affects it - Newest unaffected release: 7.2.4 (Aug 11, 2026), the latest release - Weekly downloads: 56.9K - Dependents: 18 - Releases: 212 since 2.6.2 (Jul 16, 2013) - Registry: https://pypi.org/project/mercurial/ - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2014-9390: 2.6.2 to 3.2.2 (3.2.3 is outside it) - CVE-2010-4237: no published release is affected - CVE-2019-3902: 2.6.2 to 4.9.0rc0 (4.9.0 is outside it) - CVE-2018-17983: 2.6.2 to 4.7.1 (4.7.2 is outside it) - CVE-2018-13348: 2.6.2 to 4.6.0 (4.6.1 is outside it) - CVE-2018-13347: 2.6.2 to 4.6.0 (4.6.1 is outside it) - CVE-2018-13346: 2.6.2 to 4.6.0 (4.6.1 is outside it) - CVE-2018-1000132: 2.6.2 to 4.5.0 (4.5.1 is outside it) - CVE-2017-17458: 2.6.2 to 4.4.0 (4.4.1 is outside it) - CVE-2017-1000116: 2.6.2 to 4.3.0rc0 (4.3.0 is outside it) - CVE-2017-1000115: 2.6.2 to 4.3.0 (4.3.1 is outside it) - CVE-2017-9462: 2.6.2 to 4.1.2 (4.1.3 is outside it) - CVE-2016-3105: 2.6.2 to 3.8.0rc0 (3.8.0 is outside it) - CVE-2016-3630: 2.6.2 to 3.7.2 (3.7.3 is outside it) - CVE-2016-3069: 2.6.2 to 3.7.2 (3.7.3 is outside it) - CVE-2016-3068: 2.6.2 to 3.7.2 (3.7.3 is outside it) - CVE-2014-9462: 2.6.2 to 3.2.3 (3.2.4 is outside it) - CVE-2008-2942: no published release is affected ## Advisories (18) ### [CVE-2014-9390](https://cve.now/CVE-2014-9390): Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial… - Severity: Unrated - Published: Feb 12, 2020 - Affected: fixed in 3.2.3. - Fixed in 3.2.3 (released Dec 18, 2014, 1882 days before disclosure). - The latest release, 7.2.4, is not affected. ### [CVE-2010-4237](https://cve.now/CVE-2010-4237): Mercurial before 1.6.4 fails to verify the Common Name field of SSL certificates which allows remote attackers who acquire a certificate… - Severity: Unrated - Published: Oct 29, 2019 - Affected: fixed in 1.6.4. - Fixed in 2.6.2 (released Jul 16, 2013, 2296 days before disclosure, the advisory names 1.6.4, which was never published). - The latest release, 7.2.4, is not affected. ### [CVE-2019-3902](https://cve.now/CVE-2019-3902): A flaw was found in Mercurial before 4.9. - Severity: Medium 5.1 - Published: Apr 22, 2019 - Affected: fixed in 4.9. - Fixed in 4.9.0 (released Feb 1, 2019, 80 days before disclosure). - The latest release, 7.2.4, is not affected. ### [CVE-2018-17983](https://cve.now/CVE-2018-17983): cext/manifest.c in Mercurial before 4.7.2 has an out-of-bounds read during parsing of a malformed manifest entry. - Severity: Unrated - Published: Oct 4, 2018 - Affected: fixed in 4.7.2. - Fixed in 4.7.2 (released Oct 1, 2018, 3 days before disclosure). - The latest release, 7.2.4, is not affected. ### [CVE-2018-13348](https://cve.now/CVE-2018-13348): The mpatch\_decode function in mpatch.c in Mercurial before 4.6.1 mishandles certain situations where there should be at least 12 bytes… - Severity: Unrated - Published: Jul 6, 2018 - Affected: fixed in 4.6.1. - Fixed in 4.6.1 (released Jun 6, 2018, 30 days before disclosure). - The latest release, 7.2.4, is not affected. ### [CVE-2018-13347](https://cve.now/CVE-2018-13347): mpatch.c in Mercurial before 4.6.1 mishandles integer addition and subtraction, aka OVE-20180430-0002. - Severity: Unrated - Published: Jul 6, 2018 - Affected: fixed in 4.6.1. - Fixed in 4.6.1 (released Jun 6, 2018, 30 days before disclosure). - The latest release, 7.2.4, is not affected. ### [CVE-2018-13346](https://cve.now/CVE-2018-13346): The mpatch\_apply function in mpatch.c in Mercurial before 4.6.1 incorrectly proceeds in cases where the fragment start is past the end of… - Severity: Unrated - Published: Jul 6, 2018 - Affected: fixed in 4.6.1. - Fixed in 4.6.1 (released Jun 6, 2018, 30 days before disclosure). - The latest release, 7.2.4, is not affected. ### [CVE-2018-1000132](https://cve.now/CVE-2018-1000132): Mercurial version 4.5 and earlier contains a Incorrect Access Control (CWE-285) vulnerability in Protocol server that can result in… - Severity: Unrated - Published: Mar 14, 2018 - Affected: fixed in 4.5.1. - Fixed in 4.5.1 (released Mar 6, 2018, 8 days before disclosure). - The latest release, 7.2.4, is not affected. ### [CVE-2017-17458](https://cve.now/CVE-2017-17458): In Mercurial before 4.4.1, it is possible that a specially malformed repository can cause Git subrepositories to run arbitrary code in the… - Severity: Unrated - Published: Dec 7, 2017 - Affected: fixed in 4.4.1. - Fixed in 4.4.1 (released Nov 7, 2017, 30 days before disclosure). - The latest release, 7.2.4, is not affected. ### [CVE-2017-1000116](https://cve.now/CVE-2017-1000116): Mercurial prior to 4.3 did not adequately sanitize hostnames passed to ssh, leading to possible shell-injection attacks. - Severity: Unrated - Published: Oct 4, 2017 - Affected: fixed in 4.3. - Fixed in 4.3.0 (released Aug 10, 2017, 55 days before disclosure). - The latest release, 7.2.4, is not affected. ### [CVE-2017-1000115](https://cve.now/CVE-2017-1000115): Mercurial prior to version 4.3 is vulnerable to a missing symlink check that can malicious repositories to modify files outside the… - Severity: Unrated - Published: Oct 4, 2017 - Affected: fixed in 4.3; fixed in 4.3.1. - Fixed in 4.3.1 (released Aug 10, 2017, 55 days before disclosure). - The latest release, 7.2.4, is not affected. ### [CVE-2017-9462](https://cve.now/CVE-2017-9462): In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and consequently execute… - Severity: Unrated - Published: Jun 6, 2017 - Affected: fixed in 4.1.3. - Fixed in 4.1.3 (released Apr 18, 2017, 49 days before disclosure). - The latest release, 7.2.4, is not affected. ### [CVE-2016-3105](https://cve.now/CVE-2016-3105): The convert extension in Mercurial before 3.8 might allow context-dependent attackers to execute arbitrary code via a crafted git… - Severity: Unrated - Published: May 9, 2016 - Affected: fixed in 3.8; fixed in 3.8-rc. - Fixed in 3.8.0 (released May 1, 2016, 8 days before disclosure). - The latest release, 7.2.4, is not affected. ### [CVE-2016-3630](https://cve.now/CVE-2016-3630): The binary delta decoder in Mercurial before 3.7.3 allows remote attackers to execute arbitrary code via a (1) clone, (2) push, or (3)… - Severity: Unrated - Published: Apr 13, 2016 - Affected: fixed in 3.7.3. - Fixed in 3.7.3 (released Mar 29, 2016, 15 days before disclosure). - The latest release, 7.2.4, is not affected. ### [CVE-2016-3069](https://cve.now/CVE-2016-3069): Mercurial before 3.7.3 allows remote attackers to execute arbitrary code via a crafted name when converting a Git repository. - Severity: Unrated - Published: Apr 13, 2016 - Affected: fixed in 3.7.3. - Fixed in 3.7.3 (released Mar 29, 2016, 15 days before disclosure). - The latest release, 7.2.4, is not affected. ### [CVE-2016-3068](https://cve.now/CVE-2016-3068): Mercurial before 3.7.3 allows remote attackers to execute arbitrary code via a crafted git ext:: URL when cloning a subrepository. - Severity: Unrated - Published: Apr 13, 2016 - Affected: fixed in 3.7.3. - Fixed in 3.7.3 (released Mar 29, 2016, 15 days before disclosure). - The latest release, 7.2.4, is not affected. ### [CVE-2014-9462](https://cve.now/CVE-2014-9462): The \_validaterepo function in sshpeer in Mercurial before 3.2.4 allows remote attackers to execute arbitrary commands via a crafted… - Severity: Unrated - Published: Mar 31, 2015 - Affected: fixed in 3.2.4. - Fixed in 3.2.4 (released Jan 1, 2015, 89 days before disclosure). - The latest release, 7.2.4, is not affected. ### [CVE-2008-2942](https://cve.now/CVE-2008-2942): Directory traversal vulnerability in patch.py in Mercurial 1.0.1 allows user-assisted attackers to modify arbitrary files via ".." (dot… - Severity: Unrated - Published: Jun 30, 2008 - Affected: fixed in 1.0.2. - Fixed in 2.6.2 (released Jul 16, 2013, 1842 days after disclosure, the advisory names 1.0.2, which was never published). - The latest release, 7.2.4, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/pypi/mercurial Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.