Vendor
Arbitrary File Write in Dulwich via Malicious Git Tree Paths
4 TTPsThe Dulwich Git library for Python fails to validate DOS drive letter prefixes on Windows, allowing a malicious Git repository to write files to arbitrary locations outside the designated worktree.
Dulwich Arbitrary File Write Vulnerability on Windows (CVE-2026-42305)
2 rules 2 CVEsDulwich versions before 1.2.5 are vulnerable to an arbitrary file write leading to remote code execution on Windows systems when cloning or checking out a malicious Git repository due to improper path validation, as tracked by CVE-2026-42305.
Dulwich Command Injection Vulnerability via Merge Driver
2 rules 1 TTPDulwich is vulnerable to command injection (CVE-2026-42563). By injecting malicious file paths through a crafted git tree, an attacker can achieve arbitrary command execution when a victim merges an untrusted branch because the `ProcessMergeDriver` substitutes the file path into the merge driver command via the `%P` placeholder and executes it with `subprocess.run(..., shell=True)`.