CVE-2026-42563

Dulwich is a pure-Python implementation of the Git file formats and protocols. Starting in version 0.24.0 and prior to version 1.2.5, Dulwich's `ProcessMergeDriver` substitutes the file path (from the git tree, controllable by an attacker via a malicious branch) into the merge driver command via the `%P` placeholder and executes it with `subprocess.run(..., shell=True)`. An attacker who can cause a victim to merge an untrusted branch can achieve arbitrary command execution by crafting malicious file paths. Version 1.2.5 fixes the issue.

CVSS

No CVSS.

References

Link	Resource
https://github.com/jelmer/dulwich/commit/e3331b3b3a122fc313460182f928f59723580b7b
https://github.com/jelmer/dulwich/releases/tag/dulwich-1.2.5
https://github.com/jelmer/dulwich/security/advisories/GHSA-9277-mp7x-85jf
https://github.com/jelmer/dulwich/security/advisories/GHSA-9277-mp7x-85jf

Configurations

No configuration.

History

21 Jul 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) Dulwich es una implementación pura de Python de los formatos y protocolos de archivo de Git. A partir de la versión 0.24.0 y antes de la versión 1.2.5, el 'ProcessMergeDriver' de Dulwich sustituye la ruta del archivo (del árbol de Git, controlable por un atacante a través de una rama maliciosa) en el comando del controlador de fusión a través del marcador de posición '%P' y lo ejecuta con 'subprocess.run(..., shell=True)'. Un atacante que puede hacer que una víctima fusione una rama no confiable puede lograr la ejecución arbitraria de comandos al crear rutas de archivo maliciosas. La versión 1.2.5 corrige el problema.

11 Jun 2026, 14:16

Type	Values Removed	Values Added
References	~~() https://github.com/jelmer/dulwich/security/advisories/GHSA-9277-mp7x-85jf -~~	() https://github.com/jelmer/dulwich/security/advisories/GHSA-9277-mp7x-85jf -

10 Jun 2026, 23:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-06-10 23:16

Updated : 2026-07-21 19:10

NVD link : CVE-2026-42563

Mitre link : CVE-2026-42563

CVE.ORG link : CVE-2026-42563

JSON object : View

Products Affected

No product.

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2026-42563", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42563", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-11T00:00:00+00:00"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "jelmer", "product": "dulwich", "versions": [{"status": "affected", "version": ">= 0.24.0, < 1.2.5"}]}]}], "published": "2026-06-10T23:16:46.413", "references": [{"url": "https://github.com/jelmer/dulwich/commit/e3331b3b3a122fc313460182f928f59723580b7b", "source": "security-advisories@github.com"}, {"url": "https://github.com/jelmer/dulwich/releases/tag/dulwich-1.2.5", "source": "security-advisories@github.com"}, {"url": "https://github.com/jelmer/dulwich/security/advisories/GHSA-9277-mp7x-85jf", "source": "security-advisories@github.com"}, {"url": "https://github.com/jelmer/dulwich/security/advisories/GHSA-9277-mp7x-85jf", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "Dulwich is a pure-Python implementation of the Git file formats and protocols. Starting in version 0.24.0 and prior to version 1.2.5, Dulwich's `ProcessMergeDriver` substitutes the file path (from the git tree, controllable by an attacker via a malicious branch) into the merge driver command via the `%P` placeholder and executes it with `subprocess.run(..., shell=True)`. An attacker who can cause a victim to merge an untrusted branch can achieve arbitrary command execution by crafting malicious file paths. Version 1.2.5 fixes the issue."}, {"lang": "es", "value": "Dulwich es una implementaci\u00f3n pura de Python de los formatos y protocolos de archivo de Git. A partir de la versi\u00f3n 0.24.0 y antes de la versi\u00f3n 1.2.5, el 'ProcessMergeDriver' de Dulwich sustituye la ruta del archivo (del \u00e1rbol de Git, controlable por un atacante a trav\u00e9s de una rama maliciosa) en el comando del controlador de fusi\u00f3n a trav\u00e9s del marcador de posici\u00f3n '%P' y lo ejecuta con 'subprocess.run(..., shell=True)'. Un atacante que puede hacer que una v\u00edctima fusione una rama no confiable puede lograr la ejecuci\u00f3n arbitraria de comandos al crear rutas de archivo maliciosas. La versi\u00f3n 1.2.5 corrige el problema."}], "lastModified": "2026-07-21T19:10:00.107", "sourceIdentifier": "security-advisories@github.com"}