Dulwich CVE-2026-114097

Exploitation requires that the victim run Dulwich's filter_branch with an index_filter (CommitFilter._apply_index_filter) against an attacker-controlled repository, and that the repository contain a specific cross-commit structure: an ancestor commit with a symlink tree entry (mode 120000) pointing to the target directory, and a descendant commit writing a blob beneath that symlink path. The vulnerability is gated by the absence of CWD cleanup between commit iterations and the lack of symlink protection in build_file_from_blob on versions >=0.23.1 through 1.2.7. Limiting factors: requires local access and user interaction (the victim must invoke the history-rewriting operation), affects only the index_filter code path (not plain clone/fetch/checkout), and is fixed in 1.2.8; routine Dulwich use that does not run filter_branch on untrusted repositories is not exposed.

This is a genuine but conditional code-execution risk that should be treated as moderate rather than emergency priority. The vendor-supplied CVSS 4.0 vector (AV:L/AC:L/AT:P/PR:N/UI:P) is the key signal: exploitation is LOCAL, requires no privileges but DOES require active user interaction (UI:P) - the victim must voluntarily run filter_branch with an index filter against an attacker-supplied repository - and carries an additional attack requirement (AT:P), reflecting the specific cross-commit symlink structure that must be crafted. This is not remote-unauthenticated mass-exploitable; it is an attacker-crafted-repository / supply-chain-style vector that depends on the victim performing a specific, non-routine history-rewriting operation. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified. The CVE is NOT in CISA KEV and there is no public exploit code identified at time of analysis - the GHSA advisory contains a detailed conceptual attack scenario and root-cause walkthrough but not weaponized exploit code. The signals are internally consistent: high technical impact (VC/VI/VA:H → RCE via .git/hooks) tempered by a local vector and mandatory user interaction. Net: a real, patchable defect worth remediating promptly for anyone who processes untrusted repositories with filter_branch, but low likelihood of opportunistic widespread exploitation.

An attacker publishes a crafted Git repository in which an ancestor commit contains a symlink entry (e.g. 'evil' → '/target_dir') and a descendant commit writes a file beneath that path ('evil/payload'). A victim clones the repository and runs Dulwich's filter_branch with an index filter; because the working directory is not cleaned between commits, the persisted symlink redirects the descendant's file write outside the working directory - into .git/hooks/ - achieving code execution the next time a hook fires. No public exploit code exists, though the advisory documents the full attack path.