PT-2026-44725 · Pypi · Dulwich

Published 2026-05-28 · Updated 2026-05-29 · CVE-2026-42563

Positive Technologies (AI Summary)

CVSS v4.0

7.7

High

Base vector

AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Dulwich versions prior to 1.2.5-1.1

Description Command injection occurs in the ProcessMergeDriver when the file path from the git tree is substituted into the merge driver command via the %P placeholder. This command is then executed using subprocess.run(..., shell=True). An attacker can achieve arbitrary command execution by crafting malicious file paths and inducing a victim to merge an untrusted branch, provided the user has a merge driver configured that utilizes the %P placeholder.

Recommendations Update to version 1.2.5-1.1.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-42563

GHSA-9277-MP7X-85JF

OPENSUSE-SU-2026:10900-1

Affected Products

Dulwich

References · 8

• https://osv.dev/vulnerability/openSUSE-SU-2026:10900-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9277-mp7x-85jf · Vendor Advisory
• https://github.com/jelmer/dulwich · Note
• https://github.com/jelmer/dulwich/security/advisories/GHSA-9277-mp7x-85jf · Note
• https://github.com/jelmer/dulwich/releases/tag/dulwich-1.2.5 · Note
• https://suse.com/security/cve/CVE-2026-42563 · Note
• https://suse.com/security/cve/CVE-2026-42305 · Note
• https://suse.com/security/cve/CVE-2026-47712 · Note