CVE-2026-42563 (GCVE-0-2026-42563)

Vulnerability from cvelistv5 – Published: 2026-06-10 21:47 – Updated: 2026-06-12 03:55
VLAI
Title
Dulwich Vulnerable to Command Injection via Merge Driver Path
Summary
Dulwich is a pure-Python implementation of the Git file formats and protocols. Starting in version 0.24.0 and prior to version 1.2.5, Dulwich's `ProcessMergeDriver` substitutes the file path (from the git tree, controllable by an attacker via a malicious branch) into the merge driver command via the `%P` placeholder and executes it with `subprocess.run(..., shell=True)`. An attacker who can cause a victim to merge an untrusted branch can achieve arbitrary command execution by crafting malicious file paths. Version 1.2.5 fixes the issue.
Severity
7.7 (High)
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SSVC
Exploitation: poc Automatable: no Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
  • CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
Impacted products
Vendor Product Version
jelmer dulwich Affected: >= 0.24.0, < 1.2.5
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-42563",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-11T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-12T03:55:30.892Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/jelmer/dulwich/security/advisories/GHSA-9277-mp7x-85jf"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "dulwich",
          "vendor": "jelmer",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.24.0, \u003c 1.2.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Dulwich is a pure-Python implementation of the Git file formats and protocols. Starting in version 0.24.0 and prior to version 1.2.5, Dulwich\u0027s `ProcessMergeDriver` substitutes the file path (from the git tree, controllable by an attacker via a malicious branch) into the merge driver command via the `%P` placeholder and executes it with `subprocess.run(..., shell=True)`. An attacker who can cause a victim to merge an untrusted branch can achieve arbitrary command execution by crafting malicious file paths. Version 1.2.5 fixes the issue."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-10T21:47:14.927Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/jelmer/dulwich/security/advisories/GHSA-9277-mp7x-85jf",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/jelmer/dulwich/security/advisories/GHSA-9277-mp7x-85jf"
        },
        {
          "name": "https://github.com/jelmer/dulwich/commit/e3331b3b3a122fc313460182f928f59723580b7b",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jelmer/dulwich/commit/e3331b3b3a122fc313460182f928f59723580b7b"
        },
        {
          "name": "https://github.com/jelmer/dulwich/releases/tag/dulwich-1.2.5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jelmer/dulwich/releases/tag/dulwich-1.2.5"
        }
      ],
      "source": {
        "advisory": "GHSA-9277-mp7x-85jf",
        "discovery": "UNKNOWN"
      },
      "title": "Dulwich Vulnerable to Command Injection via Merge Driver Path"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-42563",
    "datePublished": "2026-06-10T21:47:14.927Z",
    "dateReserved": "2026-04-28T17:26:12.083Z",
    "dateUpdated": "2026-06-12T03:55:30.892Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-42563",
      "date": "2026-07-27",
      "epss": "0.00555",
      "percentile": "0.42977"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-42563\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-06-10T23:16:46.413\",\"lastModified\":\"2026-07-21T19:10:00.107\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Dulwich is a pure-Python implementation of the Git file formats and protocols. Starting in version 0.24.0 and prior to version 1.2.5, Dulwich\u0027s `ProcessMergeDriver` substitutes the file path (from the git tree, controllable by an attacker via a malicious branch) into the merge driver command via the `%P` placeholder and executes it with `subprocess.run(..., shell=True)`. An attacker who can cause a victim to merge an untrusted branch can achieve arbitrary command execution by crafting malicious file paths. Version 1.2.5 fixes the issue.\"},{\"lang\":\"es\",\"value\":\"Dulwich es una implementaci\u00f3n pura de Python de los formatos y protocolos de archivo de Git. A partir de la versi\u00f3n 0.24.0 y antes de la versi\u00f3n 1.2.5, el \u0027ProcessMergeDriver\u0027 de Dulwich sustituye la ruta del archivo (del \u00e1rbol de Git, controlable por un atacante a trav\u00e9s de una rama maliciosa) en el comando del controlador de fusi\u00f3n a trav\u00e9s del marcador de posici\u00f3n \u0027%P\u0027 y lo ejecuta con \u0027subprocess.run(..., shell=True)\u0027. Un atacante que puede hacer que una v\u00edctima fusione una rama no confiable puede lograr la ejecuci\u00f3n arbitraria de comandos al crear rutas de archivo maliciosas. La versi\u00f3n 1.2.5 corrige el problema.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"jelmer\",\"product\":\"dulwich\",\"versions\":[{\"version\":\"\u003e= 0.24.0, \u003c 1.2.5\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":7.7,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"PRESENT\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"PASSIVE\",\"vulnConfidentialityImpact\":\"HIGH\",\"vulnIntegrityImpact\":\"HIGH\",\"vulnAvailabilityImpact\":\"HIGH\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-06-11T00:00:00+00:00\",\"id\":\"CVE-2026-42563\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-78\"}]}],\"references\":[{\"url\":\"https://github.com/jelmer/dulwich/commit/e3331b3b3a122fc313460182f928f59723580b7b\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/jelmer/dulwich/releases/tag/dulwich-1.2.5\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/jelmer/dulwich/security/advisories/GHSA-9277-mp7x-85jf\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/jelmer/dulwich/security/advisories/GHSA-9277-mp7x-85jf\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\"}]}}",
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-06-13T02:19:30Z",
      "cve": "CVE-2026-42563",
      "id": "CVE-2026-42563",
      "initial_release_date": "2026-06-12T02:27:44Z",
      "product_status:known_not_affected": "27",
      "product_status:recommended": "3",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-42563",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-42563.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-42563\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-06-11T13:39:52.600433Z\"}}}], \"references\": [{\"url\": \"https://github.com/jelmer/dulwich/security/advisories/GHSA-9277-mp7x-85jf\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-06-11T13:38:01.767Z\"}}], \"cna\": {\"title\": \"Dulwich Vulnerable to Command Injection via Merge Driver Path\", \"source\": {\"advisory\": \"GHSA-9277-mp7x-85jf\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV4_0\": {\"version\": \"4.0\", \"baseScore\": 7.7, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N\", \"userInteraction\": \"PASSIVE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"PRESENT\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"HIGH\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"HIGH\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"jelmer\", \"product\": \"dulwich\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003e= 0.24.0, \u003c 1.2.5\"}]}], \"references\": [{\"url\": \"https://github.com/jelmer/dulwich/security/advisories/GHSA-9277-mp7x-85jf\", \"name\": \"https://github.com/jelmer/dulwich/security/advisories/GHSA-9277-mp7x-85jf\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/jelmer/dulwich/commit/e3331b3b3a122fc313460182f928f59723580b7b\", \"name\": \"https://github.com/jelmer/dulwich/commit/e3331b3b3a122fc313460182f928f59723580b7b\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/jelmer/dulwich/releases/tag/dulwich-1.2.5\", \"name\": \"https://github.com/jelmer/dulwich/releases/tag/dulwich-1.2.5\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Dulwich is a pure-Python implementation of the Git file formats and protocols. Starting in version 0.24.0 and prior to version 1.2.5, Dulwich\u0027s `ProcessMergeDriver` substitutes the file path (from the git tree, controllable by an attacker via a malicious branch) into the merge driver command via the `%P` placeholder and executes it with `subprocess.run(..., shell=True)`. An attacker who can cause a victim to merge an untrusted branch can achieve arbitrary command execution by crafting malicious file paths. Version 1.2.5 fixes the issue.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-78\", \"description\": \"CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-06-10T21:47:14.927Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-42563\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-06-12T03:55:30.892Z\", \"dateReserved\": \"2026-04-28T17:26:12.083Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-06-10T21:47:14.927Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.