{"record":{"id":"0d06aafcd1328fc9","repo":"phacility/phabricator","slug":"you-have-an-old-version-of-mercurial-s-which-ha","errorCode":null,"errorMessage":"You have an old version of Mercurial (%s) which has a severe command injection security vulnerability. The remote URI for this repository (%s) is potentially unsafe. Upgrade Mercurial to at least 3.2.4 to clone it.","messagePattern":"You have an old version of Mercurial \\((.+?)\\) which has a severe command injection security vulnerability\\. The remote URI for this repository \\((.+?)\\) is potentially unsafe\\. Upgrade Mercurial to at least 3\\.2\\.4 to clone it\\.","errorType":"exception","errorClass":"Exception","httpStatus":null,"severity":"error","filePath":"src/applications/repository/engine/PhabricatorRepositoryPullEngine.php","lineNumber":678,"sourceCode":"    } else {\n      $remote = $repository->getRemoteURIEnvelope();\n\n      // NOTE: Mercurial prior to 3.2.4 has an severe command injection\n      // vulnerability. See: <http://bit.ly/19B58E9>\n\n      // On vulnerable versions of Mercurial, we refuse to clone remotes which\n      // contain characters which may be interpreted by the shell.\n      $hg_binary = PhutilBinaryAnalyzer::getForBinary('hg');\n      $is_vulnerable = $hg_binary->isMercurialVulnerableToInjection();\n      if ($is_vulnerable) {\n        $cleartext = $remote->openEnvelope();\n        // The use of \"%R\" here is an attempt to limit collateral damage\n        // for normal URIs because it isn't clear how long this vulnerability\n        // has been around for.\n\n        $escaped = csprintf('%R', $cleartext);\n        if ((string)$escaped !== (string)$cleartext) {\n          throw new Exception(\n            pht(\n              'You have an old version of Mercurial (%s) which has a severe '.\n              'command injection security vulnerability. The remote URI for '.\n              'this repository (%s) is potentially unsafe. Upgrade Mercurial '.\n              'to at least 3.2.4 to clone it.',\n              $hg_binary->getBinaryVersion(),\n              $repository->getMonogram()));\n        }\n      }\n\n      try {\n        $repository->execxRemoteCommand(\n          'clone --noupdate -- %P %s',\n          $remote,\n          $path);\n      } catch (Exception $ex) {\n        $message = $ex->getMessage();\n        $message = $this->censorMercurialErrorMessage($message);","sourceCodeStart":660,"sourceCodeEnd":696,"githubUrl":"https://github.com/phacility/phabricator/blob/5720a38cfe95b00ca4be5016dd0d2f3195f4fa04/src/applications/repository/engine/PhabricatorRepositoryPullEngine.php#L660-L696","documentation":"Thrown before cloning a Mercurial repository when PhutilBinaryAnalyzer reports the installed hg is a version with a known command-injection vulnerability (below 3.2.4) and the remote URI contains characters that csprintf with '%R' would escape, meaning a vulnerable shell invocation could interpret them. Phabricator refuses the clone rather than risk injection; the repository monogram (e.g. R123) is included so the admin can find it.","triggerScenarios":"The hg binary on the Phabricator host is older than 3.2.4 AND the repository remote URI contains shell metacharacters such as spaces, quotes, ampersands, or semicolons; first clone or pull of such a Mercurial repository triggers the guard before execxRemoteCommand runs.","commonSituations":"Long-lived servers running stock distro Mercurial (e.g. CentOS 7 ships hg 2.x); Mercurial remotes with passwords or unusual characters embedded in the URI; minimal installs where the vendor hg package was never upgraded.","solutions":["Upgrade Mercurial to 3.2.4 or newer on the Phabricator host; confirm with 'hg version', which removes the check entirely","If upgrading is impossible, change the repository remote URI to contain only characters that need no shell escaping","Re-run the clone or pull task after the upgrade"],"exampleFix":"# before\nhg version   # 2.6.2 (vulnerable) -> clone refused\n\n# after\nsudo apt-get install mercurial   # or build from source\nhg version   # 4.x -> clone proceeds","handlingStrategy":"validation","validationCode":"// Before adding a Mercurial repository, verify the binary is patched:\n$hg = PhutilBinaryAnalyzer::getForBinary('hg');\nif ($hg->isMercurialVulnerableToInjection()) {\n  // refuse to configure the repository until hg >= 3.2.4\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Pin Mercurial 3.2.4 or newer in host provisioning from day one","Keep repository remote URIs free of shell metacharacters where possible","Periodically audit VCS binary versions on the Phabricator host"],"tags":["phabricator","mercurial","security","command-injection","version-check"],"backgroundTag":"command-injection-vulnerability","analyzedSha":"5720a38cfe95b00ca4be5016dd0d2f3195f4fa04","analyzedAt":"2026-08-21T05:07:25.672Z","schemaVersion":2},"datasetVersion":"2026-08-21T11:28:35.574Z"}