Product
The Dulwich library stash pop implementation fails to validate symlinks, allowing attackers to write arbitrary files outside the repository worktree and achieve remote code execution.