CVE-2026-42563
NoneCVSS
—
EPSS
0.8%
Published
Jun 10, 2026
CISA due date
—
The record
Dulwich is a pure-Python implementation of the Git file formats and protocols. Starting in version 0.24.0 and prior to version 1.2.5, Dulwich's `ProcessMergeDriver` substitutes the file path (from the git tree, controllable by an attacker via a malicious branch) into the merge driver command via the `%P` placeholder and executes it with `subprocess.run(..., shell=True)`. An attacker who can cause a victim to merge an untrusted branch can achieve arbitrary command execution by crafting malicious file paths. Version 1.2.5 fixes the issue.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Tumbleweed | python-dulwich | 0 | 1.2.5-1.1 |
Related vulnerabilities
- CVE-2026-47712 Dulwich is a pure-Python implementation of the Git file formats and protocols. Also affects python-dulwich
- CVE-2026-42305 Dulwich is a pure-Python implementation of the Git file formats and protocols. Also affects python-dulwich
- CVE-2026-96376 Improper Neutralization of Special Elements used in an OS Command ("OS Command… CWE-78
- CVE-2026-113732 virtualenv is a tool for creating isolated virtual python environments. CWE-78
- CVE-2026-113776 virtualenv is a tool for creating isolated virtual python environments. CWE-78
- CVE-2026-113726 virtualenv is a tool for creating isolated virtual python environments. CWE-78
- CVE-2026-113725 virtualenv is a tool for creating isolated virtual python environments. CWE-78
- CVE-2026-113722 virtualenv is a tool for creating isolated virtual python environments. CWE-78