Tag
high
advisory
Dulwich Arbitrary File Write Vulnerability on Windows (CVE-2026-42305)
2 rules 2 CVEsDulwich versions before 1.2.5 are vulnerable to an arbitrary file write leading to remote code execution on Windows systems when cloning or checking out a malicious Git repository due to improper path validation, as tracked by CVE-2026-42305.
dulwich
arbitrary-file-write
remote-code-execution
git
2r
2c
high
threat
Dulwich Command Injection Vulnerability via Merge Driver
2 rules 1 TTPDulwich is vulnerable to command injection (CVE-2026-42563). By injecting malicious file paths through a crafted git tree, an attacker can achieve arbitrary command execution when a victim merges an untrusted branch because the `ProcessMergeDriver` substitutes the file path into the merge driver command via the `%P` placeholder and executes it with `subprocess.run(..., shell=True)`.
dulwich
command injection
git
cve-2026-42563
2r
1t