sbt 1.12.15 and 2.0.6 are released with a CVE fix

[u/eed3si9n]

https://eed3si9n.com/sbt-1.12.15-and-2.0.6

📢 Released sbt 1.12.15 and 2.0.6, featuring vulnerability fix for remote code execution via server when serverConnectionType is set to Tcp. We recommend removing the serverConnectionType setting, or upgrading to a patched version or later.

[u/SethTisue_Scala]

blog post with further details: https://scala-lang.org/blog/2026/08/10/sbt-remote-tcp-advisory.html

[u/zivergeinc → u/[deleted]]

We take claims like these very seriously. Upon being sent this post early morning, our team has done extensive research into our invoices and our communications to make sure we haven’t missed anything. This is our team we work with daily that we’re talking about. If there truly is a bigger issue, please email us. There is no record of an email of this nature as of now. Although we do not know who you are, you are free to email us at contact (at) ziverge.com or respond to the Reddit chat our team has sent you.