Dulwich EUVD-2026-106899

Exploitation requires that the victim (1) obtain and process an attacker-controlled repository containing a worktree entry that is a symlink (mode 120000) resolving to .git/hooks/post-checkout or another sensitive path, and (2) specifically invoke porcelain.checkout(paths=[...]) to selectively restore that path from an attacker-chosen ref/tag that holds the file as a regular/executable blob. Limiting factors: exploitation is local and depends on the victim using the selective paths= checkout API (not merely cloning), on the victim targeting the crafted ref, and on user interaction (UI:P); it does not trigger from a plain clone or default full checkout alone. Affected versions are Dulwich 0.24.0 through 1.2.7; upgrading to 1.2.8 removes the condition.

This is a credible but conditional risk rather than a drop-everything emergency. The CVSS 4.0 vector (AV:L/AC:L/AT:P/PR:N/UI:P) scores 7.3 (High) and correctly captures the key constraints: exploitation is LOCAL (the victim must process a crafted repository on their own machine), requires a present attack condition (AT:P - the victim must invoke the specific checkout(paths=[...]) code path restoring a file from an attacker-controlled ref), and requires passive user interaction (UI:P). PR:N is accurate in the sense that the attacker needs no account or privileges on the victim system - they only need to get the victim to clone and selectively check out a malicious repo. Technical impact is high: arbitrary file write with attacker-controlled permissions leading to RCE via a planted .git/hooks/post-checkout hook. No EPSS score and no KEV listing are present in the input, and there is no public exploit code identified - only a detailed written reproduction in the GHSA advisory. There is no conflict between the signals: all of them point to a serious-but-narrow supply-chain/tooling vulnerability whose exploitation depends on victim workflow (using the paths= selective-checkout API), not on broad remote reachability. Priority should be elevated for environments that run Dulwich-based tooling against untrusted repositories, and moderate elsewhere. Note the attack vector is genuinely local/workflow-dependent despite the 'remote repo' framing - the trigger is the victim's own checkout operation, so AV:L is appropriate.

An attacker publishes a repository whose HEAD contains a worktree entry 'trigger' as a symlink (mode 120000) pointing to ../../.git/hooks/post-checkout, while a tag such as v1.0 holds 'trigger' as an executable blob containing a malicious shell script. When a victim clones the repo and runs porcelain.checkout(paths=["trigger"]) to restore that file from the tag, the raw os.open without O_NOFOLLOW follows the symlink and writes the payload into the git hook, achieving code execution on the next checkout. No public exploit code is identified, but the advisory provides a complete step-by-step reproduction.