Which versions of Dulwich are affected by CVE-2026-42563?

Dulwich, a pure-Python Git library used in development and build environments, contains a vulnerability enabling arbitrary code execution when developers merge attacker-controlled branches configured…. A patch is available.

How to fix or mitigate CVE-2026-42563?

24 hours: Inventory all systems using Dulwich; determine versions currently deployed; identify any custom merge driver configurations in use. 7 days: Deploy Dulwich version 1.2.5 or later to all affected systems; validate successful patching; review necessity and configuration of custom merge drivers. 30 days: Confirm patch deployment across all development and CI/CD infrastructure; implement automated scanning for vulnerable Python dependencies; establish security policies governing merge driver configurations.

Dulwich CVE-2026-42563

Q: What is the CVSS score of CVE-2026-42563?

CVE-2026-42563 has a CVSS 4.0 base score of 7.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

HIGH

OS Command Injection (CWE-78)

2026-05-28 https://github.com/jelmer/dulwich

GHSA-9277-mp7x-85jf

Command Injection RCE Python

7.7

CVSS 4.0 · Vendor: https://github.com/jelmer/dulwich

Severity by source

Vendor (https://github.com/jelmer/dulwich) PRIMARY

7.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Delivered via network-reachable Git branch (AV:N); requires non-default %P merge driver config (AC:H); attacker needs no privileges (PR:N); victim must perform the merge (UI:R); shell RCE yields full C/I/A:H.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (https://github.com/jelmer/dulwich).

CVSS VectorVendor: https://github.com/jelmer/dulwich

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Updated

Jun 10, 2026 - 23:29 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 10, 2026 - 23:29 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 10, 2026 - 23:22 vuln.today

cvss_changed

CVSS changed

Jun 10, 2026 - 23:22 NVD

7.7 (HIGH)

Source Code Evidence Fetched

May 28, 2026 - 22:50 vuln.today

Analysis Generated

May 28, 2026 - 22:50 vuln.today

DescriptionCVE.org

Summary

Dulwich's ProcessMergeDriver substitutes the file path (from the git tree, controllable by an attacker via a malicious branch) into the merge driver command via the %P placeholder and executes it with subprocess.run(..., shell=True). An attacker who can cause a victim to merge an untrusted branch can achieve arbitrary command execution by crafting malicious file paths.

Description

Type: Command Injection
Source: merge.py line 195 - path from merge tree (from repository content when merging untrusted branch)
Sink: merge_drivers.py lines 124-127 - subprocess.run(cmd, shell=True) where cmd includes path via %P placeholder
Impact: Arbitrary code execution when merging from a malicious repository. Requires the user to have a merge driver configured that uses the %P placeholder.

Resources

Repository: https://github.com/dulwich/dulwich
Vulnerable file: dulwich/merge_drivers.py (lines 119-129)

Proof of Concept

python

from dulwich.attrs import GitAttributes, Pattern
from dulwich.config import ConfigDict
from dulwich.merge import merge_blobs
from dulwich.objects import Blob
# Merge driver with %P (path) - typical for custom merge tools
config = ConfigDict()
config.set((b"merge", b"injectable"), b"driver", b"echo %P > %A")

patterns = [(Pattern(b"*"), {b"merge": b"injectable"})]
gitattributes = GitAttributes(patterns)

base = Blob.from_string(b"base")
ours = Blob.from_string(b"ours")
theirs = Blob.from_string(b"theirs")
# Malicious path from attacker-controlled git tree: injects "touch /tmp/pwned"
malicious_path = b"x; touch /tmp/pwned #"

merge_blobs(base, ours, theirs, path=malicious_path,
            gitattributes=gitattributes, config=config)
# => Executes: echo x; touch /tmp/pwned
#
# => Shell runs: echo x, then touch /tmp/pwned

Fix

merge_drivers_shell_escape.patch

AnalysisAI

Command injection in Dulwich (pure-Python Git implementation) versions >= 0.24.0 and < 1.2.5 allows remote attackers to execute arbitrary OS commands when a victim merges an attacker-controlled branch and has a custom merge driver configured that references the %P placeholder. The ProcessMergeDriver passes attacker-controlled file paths from the git tree into subprocess.run with shell=True, so a path like 'x; touch /tmp/pwned #' is interpreted as a shell metacharacter sequence. Publicly available exploit code exists (working POC in the GitHub Security Advisory GHSA-9277-mp7x-85jf); no public exploit in CISA KEV at time of analysis.

Technical ContextAI

Dulwich is a pure-Python implementation of the Git file formats and protocols, widely embedded in development tooling, build systems and Git hosting code. The flaw is a classic CWE-78 OS command injection in dulwich/merge_drivers.py (lines 119-129): the ProcessMergeDriver builds a shell command by string-substituting the file's repository path into the %P placeholder of the configured merge.<driver>.driver command, then runs it via subprocess.run(cmd, shell=True). Because the path originates from the merge tree (merge.py line 195) and Git tree entry names are not constrained to shell-safe characters, an attacker who controls a branch can choose a path that contains shell metacharacters such as ';', '|' or backticks, which the shell then interprets as additional commands. The fix shell-quotes substituted values before invoking the shell.

RemediationAI

Vendor-released patch: upgrade Dulwich to version 1.2.5 or later (pip install --upgrade 'dulwich>=1.2.5'), which shell-quotes values substituted into ProcessMergeDriver commands per the security release notes at https://github.com/jelmer/dulwich/releases/tag/dulwich-1.2.5 and the advisory at https://github.com/jelmer/dulwich/security/advisories/GHSA-9277-mp7x-85jf. If immediate upgrade is not possible, remove any merge driver configuration that uses the %P placeholder from .gitattributes and .git/config (and from any system or global Git config consumed by Dulwich) - the side effect is loss of custom merge-driver behavior for the affected file patterns, falling back to the default three-way merge. As an operational compensating control, avoid merging branches from untrusted remotes through Dulwich-based tooling (including automated bots and CI pipelines that fetch arbitrary fork branches) until the upgrade is rolled out; the trade-off is reduced automation throughput for fork/PR workflows.