Skip to content
Threat Feed
Subscribe

Product

Dulwich (< 1.2.20)

1 brief RSS
high advisory

Dulwich and Poetry: Arbitrary code execution via commit object parsing (CVE-2026-122299)

Dulwich versions before 1.2.20 contain a parsing vulnerability that causes inconsistent tree header resolution, potentially allowing code execution when used by Poetry 2.5.1.

PoC Dulwich +1
1c