https://feed.craftedsignal.io/vendors/dulwich/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 28 May 2026 22:30:30 +0000https://feed.craftedsignal.io/briefs/2026-05-dulwich-arbitrary-file-write/Thu, 28 May 2026 22:30:30 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-05-dulwich-arbitrary-file-write/Dulwich versions before 1.2.5 are vulnerable to an arbitrary file write leading to remote code execution on Windows systems when cloning or checking out a malicious Git repository due to improper path validation, as tracked by CVE-2026-42305.Dulwich versions before 1.2.5 are vulnerable to an arbitrary file write vulnerability (CVE-2026-42305) on Windows. The vulnerability occurs because Dulwich's path-element validator accepts tree entries with filenames containing bytes that Windows interprets as structural path syntax, such as backslashes (\), NTFS alternate-data-stream markers (:), and NTFS 8.3 short-name aliases (git~<digits>). This allows an attacker to craft malicious Git repositories that, when cloned or checked out on Windows, can write files to arbitrary locations, including inside the .git directory. If a file is planted as a Git hook (e.g., .git\hooks\pre-commit.exe), it can lead to remote code execution when a user commits changes. POSIX systems are not directly exploitable, but can propagate malicious trees to Windows.

Attack Chain

1. An attacker crafts a malicious Git repository containing a tree entry with a filename including a backslash (e.g., .git\hooks\pre-commit.exe).
2. The attacker hosts the malicious Git repository on a publicly accessible server.
3. A victim user clones the malicious repository using Dulwich on a Windows system (e.g., using dulwich.porcelain.clone).
4. Dulwich's path-element validator incorrectly processes the backslash in the filename.
5. The malicious file is written to the .git\hooks directory within the victim's local repository, creating the directory structure .git/hooks/pre-commit.exe.
6. The victim user attempts to commit changes to the repository using Git.
7. Git executes the planted hook script (.git/hooks/pre-commit.exe).
8. The attacker achieves arbitrary code execution in the context of the victim user on the Windows system.

Impact

Successful exploitation of this vulnerability allows an attacker to achieve arbitrary file write and remote code execution on vulnerable Windows systems. This can lead to complete system compromise, data theft, and further lateral movement within the victim's network. The scope of impact depends on the number of developers and systems using affected Dulwich versions and cloning untrusted repositories.

Recommendation

• Upgrade Dulwich to version 1.2.5 or later to patch CVE-2026-42305.
• Deploy the Sigma rule "Detect Dulwich Git Hook Write via Malicious Filename" to detect attempts to write Git hooks with suspicious filenames.
• Block the use of affected Dulwich versions in your environment until they are patched.
• Audit existing Git repositories for malicious tree entries that may have been introduced through vulnerable Dulwich versions.

]]>highadvisoryarbitrary-file-writeremote-code-executiongitdulwichhttps://feed.craftedsignal.io/briefs/2026-05-dulwich-command-injection/Thu, 28 May 2026 22:30:17 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-05-dulwich-command-injection/Dulwich is vulnerable to command injection (CVE-2026-42563). By injecting malicious file paths through a crafted git tree, an attacker can achieve arbitrary command execution when a victim merges an untrusted branch because the `ProcessMergeDriver` substitutes the file path into the merge driver command via the `%P` placeholder and executes it with `subprocess.run(..., shell=True)`.Dulwich, a Python implementation of Git, is susceptible to a command injection vulnerability (CVE-2026-42563) affecting versions 0.24.0 to 1.2.5. An attacker can exploit this flaw by crafting malicious file paths within a Git tree, which are then injected into merge driver commands during a merge operation. The vulnerability resides in the ProcessMergeDriver, where the file path (controlled by the attacker via a malicious branch) is substituted into the merge driver command via the %P placeholder and executed using subprocess.run(..., shell=True). This allows an attacker who can cause a victim to merge an untrusted branch to achieve arbitrary command execution. This issue is significant for environments where Dulwich is used to manage Git repositories and where merges from untrusted sources are performed, potentially leading to compromise of the system executing the merge.

Attack Chain

1. Attacker creates a malicious Git repository with a crafted branch.
2. The malicious branch contains a file with a specially crafted path designed for command injection.
3. The attacker induces a victim to merge the malicious branch into their repository.
4. During the merge process, Dulwich's ProcessMergeDriver is invoked for files with merge drivers configured.
5. The malicious file path is passed to the merge driver command via the %P placeholder.
6. subprocess.run(cmd, shell=True) executes the crafted command, injecting shell commands from the malicious path.
7. Arbitrary commands are executed on the victim's system with the privileges of the user running the merge operation.
8. The attacker achieves arbitrary code execution, potentially leading to complete system compromise.

Impact

Successful exploitation of this vulnerability allows for arbitrary command execution on the affected system. This can lead to a complete compromise of the system, including data theft, modification, or destruction. The impact is especially severe if Dulwich is used in automated systems or environments where merges from untrusted sources are common. The vulnerability affects versions 0.24.0 to 1.2.5 of the pip/dulwich package. The number of potential victims is dependent on the number of deployments using the vulnerable versions of Dulwich that merge code from untrusted sources.

Recommendation

• Upgrade to Dulwich version 1.2.5 or later to remediate CVE-2026-42563.
• Deploy the Sigma rule "Detect Dulwich Merge Driver Command Injection" to identify exploitation attempts via malicious merge driver configurations and command execution.
• Review custom merge driver configurations to ensure proper sanitization of file paths used in merge commands to mitigate similar command injection vulnerabilities.
• Implement controls to validate the integrity and trustworthiness of Git repositories and branches before merging them into production environments to prevent malicious code injection.

]]>highthreatcommand injectiondulwichgitcve-2026-42563