The convert extension in Mercurial before 3.8 might allow context-dependent attackers to execute arbitrary code via a crafted git repository name. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-3105
