RCE in Jelmer Dulwich
CVE-2026-42563
Dulwich is a pure-Python implementation of the Git file formats and protocols. Starting in version 0.24.0 and prior to version 1.2.5, Dulwich's `ProcessMergeDriver` substitutes the file path (from the git tree, controllable by an attacker…
Vulnerability class: Command Injection (OS Command Injection)
EPSS: 0.006 (43.0th percentile) — read the EPSS interpretation.
Affected products
- Jelmer Dulwich — versions >= 0.24.0, < 1.2.5
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_CONFIRM)