Poetry (2.5.1) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/poetry-2.5.1/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 05 Nov 2026 00:08:04 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgDulwich and Poetry: Arbitrary code execution via commit object parsing (CVE-2026-122299)https://feed.craftedsignal.io/briefs/2026-11-dulwich-poetry-vulnerability/Thu, 05 Nov 2026 00:08:04 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-dulwich-poetry-vulnerability/Dulwich versions before 1.2.20 contain a parsing vulnerability that causes inconsistent tree header resolution, potentially allowing code execution when used by Poetry 2.5.1.Dulwich versions prior to 1.2.20 contain a vulnerability in the _parse_commit function where duplicate tree headers are resolved to the last occurrence rather than the first, which diverges from standard Git behavior. Poetry 2.5.1 uses Dulwich by default for git dependency installation. An attacker can craft a commit object with two tree headers so that standard Git clients see a benign tree, while Poetry's dulwich-based checkout resolves to an attacker-controlled tree containing malicious build scripts, such as setup.py, resulting in unreviewed code execution on the install or build host.

]]>highadvisory