CVE-2026-122299 Details

A vulnerability in Dulwich versions prior to 1.2.20 allows for improper parsing of commit objects. The issue arises because the parsing function '_parse_commit' resolves duplicate tree headers incorrectly, favoring the last occurrence instead of the first. This behavior deviates from core Git's handling of such headers. The vulnerability is particularly concerning because it can be exploited in environments where Dulwich is used for Git dependency management, such as with Poetry version 2.5.1. Attackers can craft commit objects with multiple tree headers, creating a scenario where continuous integration (CI) systems see a harmless tree, while the version of Dulwich used by Poetry accesses a different, maliciously controlled tree. This tree could contain harmful build scripts, like 'setup.py', leading to unauthorized code execution on the host where the installation or build occurs.

Users can upgrade to Dulwich version 1.2.20 or later, where this vulnerability has been addressed.