CVE-2026-42563 Details
Description
Dulwich is a pure-Python implementation of the Git file formats and protocols. Starting in version 0.24.0 and prior to version 1.2.5, Dulwich's `ProcessMergeDriver` substitutes the file path (from the git tree, controllable by an attacker via a malicious branch) into the merge driver command via the `%P` placeholder and executes it with `subprocess.run(..., shell=True)`. An attacker who can cause a victim to merge an untrusted branch can achieve arbitrary command execution by crafting malicious file paths. Version 1.2.5 fixes the issue.
A command injection vulnerability has been identified in Dulwich, a pure-Python implementation of Git file formats and protocols. This issue affects versions 0.24.0 prior to 1.2.5. The vulnerability arises in the `ProcessMergeDriver`, which executes merge commands with `subprocess.run(..., shell=True)`. The `%P` placeholder, representing a file path from the Git tree, can be manipulated by an attacker through a malicious branch to inject and execute arbitrary commands. Exploitation requires the victim to merge an untrusted branch while having a merge driver that references `%P` configured.
Users can upgrade to Dulwich version 1.2.5, which addresses this vulnerability by properly quoting the injected file paths before execution.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 10, 2026CISA-ADP
Assessed Jun 11, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/jelmer/dulwich/security/advisories/GHSA-9277-mp7x-85jf | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/jelmer/dulwich/commit/e3331b3b3a122fc313460182f928f59723580b7b | [email protected] | Source CodeVendor |
| https://github.com/jelmer/dulwich/releases/tag/dulwich-1.2.5 | [email protected] | Release NotesVendor |
| https://github.com/jelmer/dulwich/security/advisories/GHSA-9277-mp7x-85jf | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Dulwich | >= 0.24.0, < 1.2.5 (semver) |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 21, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 11, 2026 | CVE Modified | CISA-ADP |
| Jun 10, 2026 | New CVE Received | [email protected] |