Arbitrary Command Execution in Dulwich by Attacker-Controlled File Path

CVE-2026-42563

What is CVE-2026-42563?

Dulwich, a Python implementation of Git's file formats, has a vulnerability in its ProcessMergeDriver. This flaw occurs in versions before 1.2.5, where an attacker can inject malicious file paths via a compromised Git branch. When a victim executes a merge involving this untrusted branch, the merge driver executes the injected command using subprocess.run(..., shell=True), leading to the possibility of arbitrary command execution. Users are advised to upgrade to version 1.2.5 to mitigate this risk.

References