CVE-2017-17536

CVE-2017-17536 affects Phabricator before 2017-11-10 where the web UI can trigger execution of arbitrary code in the Mercurial (hg) client by a branch name starting with a --config= or --debugger= substring. The underlying issue is that --config and --debugger flags are not blocked, enabling remo...