CVE-2016-3069: Mercurial Remote Code Execution
Summary
CVE-2016-3069: Mercurial before 3.7.3 allows remote attackers to execute arbitrary code via a crafted name when converting a Git repository. Affects mercurial versions < 3.7.3. Fixed in 3.7.3. How to fix ↓
Also tracked for
- mercurial · Debian:11
The same CVE-2016-3069 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mercurial is a distributed version control system (DVCS) that provides a fast and scalable solution for managing source code repositories. It is widely used in software development to track changes, collaborate on projects, and manage code history. However, versions of Mercurial prior to 3.7.3 are vulnerable to remote code execution when converting a Git repository. This vulnerability can be exploited by remote attackers through a crafted name, potentially leading to arbitrary code execution on the target system.
Vulnerability Detail
The vulnerability (CVE-2016-3069) in Mercurial arises from a flaw in the handling of repository conversions from Git. By providing a specially crafted name during the conversion process, an attacker can trigger the execution of arbitrary code. This can have severe consequences, including unauthorized access to sensitive information, system compromise, and potential further exploitation of the affected system. It is crucial to address this vulnerability promptly to mitigate the risk of exploitation.
How To Fix
Latest published version: 7.2.4 as of 22 Oct 2026
pip install --upgrade "mercurial==7.2.4"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.7.3
This is the first release that contains the fix.
pip install --upgrade "mercurial==3.7.3"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the official patch or update to the latest version of Mercurial to eliminate the risk of remote code execution.
Conclusion
The vulnerability (CVE-2016-3069) in Mercurial allows remote code execution and poses a significant risk to systems running vulnerable versions. It is crucial to update to the latest version of Mercurial (3.7.3 or later) to mitigate this vulnerability. Failure to address this issue promptly may result in unauthorized access, system compromise, and potential further exploitation. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for mercurial →
FAQ
Mercurial is a distributed version control system (DVCS) used for managing source code repositories.
This vulnerability allows remote attackers to execute arbitrary code on systems running vulnerable versions of Mercurial.
To fix this vulnerability, update the Mercurial package to version 3.7.3 or later.
No, there is no known workaround for this vulnerability. Updating to the latest version is the recommended solution.
For more information about this vulnerability, refer to the official advisory at https://github.com/pypa/advisory-database/blob/main/vulns/mercurial/PYSEC-2016-27.yaml
Related vulnerabilities
Recent vulnerabilities recorded for mercurial.
