CVE-2026-42563

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-42563", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-28T17:26:12.083Z", "datePublished": "2026-06-10T21:47:14.927Z", "dateUpdated": "2026-06-12T03:55:30.892Z"}, "containers": {"cna": {"title": "Dulwich Vulnerable to Command Injection via Merge Driver Path", "problemTypes": [{"descriptions": [{"cweId": "CWE-78", "lang": "en", "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/jelmer/dulwich/security/advisories/GHSA-9277-mp7x-85jf", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/jelmer/dulwich/security/advisories/GHSA-9277-mp7x-85jf"}, {"name": "https://github.com/jelmer/dulwich/commit/e3331b3b3a122fc313460182f928f59723580b7b", "tags": ["x_refsource_MISC"], "url": "https://github.com/jelmer/dulwich/commit/e3331b3b3a122fc313460182f928f59723580b7b"}, {"name": "https://github.com/jelmer/dulwich/releases/tag/dulwich-1.2.5", "tags": ["x_refsource_MISC"], "url": "https://github.com/jelmer/dulwich/releases/tag/dulwich-1.2.5"}], "affected": [{"vendor": "jelmer", "product": "dulwich", "versions": [{"version": ">= 0.24.0, < 1.2.5", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-10T21:47:14.927Z"}, "descriptions": [{"lang": "en", "value": "Dulwich is a pure-Python implementation of the Git file formats and protocols. Starting in version 0.24.0 and prior to version 1.2.5, Dulwich's `ProcessMergeDriver` substitutes the file path (from the git tree, controllable by an attacker via a malicious branch) into the merge driver command via the `%P` placeholder and executes it with `subprocess.run(..., shell=True)`. An attacker who can cause a victim to merge an untrusted branch can achieve arbitrary command execution by crafting malicious file paths. Version 1.2.5 fixes the issue."}], "source": {"advisory": "GHSA-9277-mp7x-85jf", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/jelmer/dulwich/security/advisories/GHSA-9277-mp7x-85jf", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-11T00:00:00+00:00", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2026-42563"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-12T03:55:30.892Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-42563", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-06-11T13:39:52.600433Z"}}}], "references": [{"url": "https://github.com/jelmer/dulwich/security/advisories/GHSA-9277-mp7x-85jf", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-11T13:38:01.767Z"}}], "cna": {"title": "Dulwich Vulnerable to Command Injection via Merge Driver Path", "source": {"advisory": "GHSA-9277-mp7x-85jf", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 7.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "jelmer", "product": "dulwich", "versions": [{"status": "affected", "version": ">= 0.24.0, < 1.2.5"}]}], "references": [{"url": "https://github.com/jelmer/dulwich/security/advisories/GHSA-9277-mp7x-85jf", "name": "https://github.com/jelmer/dulwich/security/advisories/GHSA-9277-mp7x-85jf", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/jelmer/dulwich/commit/e3331b3b3a122fc313460182f928f59723580b7b", "name": "https://github.com/jelmer/dulwich/commit/e3331b3b3a122fc313460182f928f59723580b7b", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/jelmer/dulwich/releases/tag/dulwich-1.2.5", "name": "https://github.com/jelmer/dulwich/releases/tag/dulwich-1.2.5", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Dulwich is a pure-Python implementation of the Git file formats and protocols. Starting in version 0.24.0 and prior to version 1.2.5, Dulwich's `ProcessMergeDriver` substitutes the file path (from the git tree, controllable by an attacker via a malicious branch) into the merge driver command via the `%P` placeholder and executes it with `subprocess.run(..., shell=True)`. An attacker who can cause a victim to merge an untrusted branch can achieve arbitrary command execution by crafting malicious file paths. Version 1.2.5 fixes the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-78", "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-10T21:47:14.927Z"}}}, "cveMetadata": {"cveId": "CVE-2026-42563", "state": "PUBLISHED", "dateUpdated": "2026-06-12T03:55:30.892Z", "dateReserved": "2026-04-28T17:26:12.083Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-06-10T21:47:14.927Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "dulwich", "vendor": "jelmer", "versions": [{"status": "affected", "version": ">= 0.24.0, < 1.2.5"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Dulwich is a pure-Python implementation of the Git file formats and protocols. Starting in version 0.24.0 and prior to version 1.2.5, Dulwich's `ProcessMergeDriver` substitutes the file path (from the git tree, controllable by an attacker via a malicious branch) into the merge driver command via the `%P` placeholder and executes it with `subprocess.run(..., shell=True)`. An attacker who can cause a victim to merge an untrusted branch can achieve arbitrary command execution by crafting malicious file paths. Version 1.2.5 fixes the issue."}, {"lang": "es", "value": "Dulwich es una implementaci\u00f3n pura de Python de los formatos y protocolos de archivo de Git. A partir de la versi\u00f3n 0.24.0 y antes de la versi\u00f3n 1.2.5, el 'ProcessMergeDriver' de Dulwich sustituye la ruta del archivo (del \u00e1rbol de Git, controlable por un atacante a trav\u00e9s de una rama maliciosa) en el comando del controlador de fusi\u00f3n a trav\u00e9s del marcador de posici\u00f3n '%P' y lo ejecuta con 'subprocess.run(..., shell=True)'. Un atacante que puede hacer que una v\u00edctima fusione una rama no confiable puede lograr la ejecuci\u00f3n arbitraria de comandos al crear rutas de archivo maliciosas. La versi\u00f3n 1.2.5 corrige el problema."}], "id": "CVE-2026-42563", "lastModified": "2026-07-21T19:10:00.107", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42563", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-06-11T00:00:00+00:00", "version": "2.0.3"}}]}, "published": "2026-06-10T23:16:46.413", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/jelmer/dulwich/commit/e3331b3b3a122fc313460182f928f59723580b7b"}, {"source": "security-advisories@github.com", "url": "https://github.com/jelmer/dulwich/releases/tag/dulwich-1.2.5"}, {"source": "security-advisories@github.com", "url": "https://github.com/jelmer/dulwich/security/advisories/GHSA-9277-mp7x-85jf"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/jelmer/dulwich/security/advisories/GHSA-9277-mp7x-85jf"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-78"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.24.0,1.2.5)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "dulwich", "source": "cna", "vendor": "jelmer"}, "product": "dulwich", "vendor": "jelmer"}], "created": "2026-06-10T23:30:44.136185+00:00", "updated": "2026-06-11T10:40:43.157011+00:00", "vendors": ["jelmer", "jelmer$PRODUCT$dulwich"]}