CVE-2026-103060: rebar3 3.7.0-rc1 to before 3.27.2

Affected technology

rebar3 · 3.7.0-rc1 to before 3.27.2
erlang

rebar3 · 56b7d88975aa8da6446857cfd92de0825024bf63 to before e35282b26e499b1d9e8f30bba9dccd71cd8b02ba
erlang

Component: rebar_packages, rebar_app_utils, rebar_fetch
Function: rebar_packages:parse_deps/1, rebar_app_utils:dep_to_app/7, rebar_fetch:download_source/2, rebar_fetch:download_source_online/2
File: apps/rebar/src/rebar_packages.erl, apps/rebar/src/rebar_app_utils.erl, apps/rebar/src/rebar_fetch.erl

Attack conditions (Source advisory, CVSS 4.0): Network (remote) · No privileges required · Active user interaction

What an attacker can do

Source advisory’s CVSS 4.0 assessment (base score 7.5/10) rates confidentiality, integrity and availability impact as high. The description does not specify what an attacker can achieve beyond these rated impacts.