{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/poetry/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-122299"}],"_cs_exploited":false,"_cs_has_poc":true,"_cs_poc_references":["https://sploitus.com/exploit?id=CVE-2026-122299\u0026utm_source=rss\u0026utm_medium=rss"],"_cs_products":["Dulwich (\u003c 1.2.20)","Poetry (2.5.1)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Dulwich","Poetry"],"content_html":"\u003cp\u003eDulwich versions prior to 1.2.20 contain a vulnerability in the \u003ccode\u003e_parse_commit\u003c/code\u003e function where duplicate tree headers are resolved to the last occurrence rather than the first, which diverges from standard Git behavior. Poetry 2.5.1 uses Dulwich by default for git dependency installation. An attacker can craft a commit object with two tree headers so that standard Git clients see a benign tree, while Poetry's dulwich-based checkout resolves to an attacker-controlled tree containing malicious build scripts, such as \u003ccode\u003esetup.py\u003c/code\u003e, resulting in unreviewed code execution on the install or build host.\u003c/p\u003e\n","date_modified":"2026-11-05T00:20:57Z","date_published":"2026-11-05T00:08:04Z","id":"https://feed.craftedsignal.io/briefs/2026-11-dulwich-poetry-vulnerability/","summary":"Dulwich versions before 1.2.20 contain a parsing vulnerability that causes inconsistent tree header resolution, potentially allowing code execution when used by Poetry 2.5.1.","title":"Dulwich and Poetry: Arbitrary code execution via commit object parsing (CVE-2026-122299)","url":"https://feed.craftedsignal.io/briefs/2026-11-dulwich-poetry-vulnerability/"}],"language":"en","title":"CraftedSignal Threat Feed - Poetry","version":"https://jsonfeed.org/version/1.1"}