Commit Object Parsing Vulnerability in Dulwich by Dulwich

CVE-2026-122299

What is CVE-2026-122299?

Dulwich versions prior to 1.2.20 exhibit a vulnerability in the commit object parsing routine. When a commit object includes two tree headers, the parsing mechanism resolves the duplicate header incorrectly, favoring the last occurrence rather than adhering to core git's expected behavior. This flaw allows attackers to craft a malicious commit object, presenting a benign tree structure to reviewers and continuous integration systems while redirecting direct installations through Poetry to an attacker-controlled tree. Consequently, this manipulation can lead to the execution of unreviewed and potentially harmful code during the build or installation processes.

References