Skip to content
CVE PROGRAM SOURCE RECORD7.3 High

CVE-2026-114096

Dulwich 0.24.0 before 1.2.8 Symlink Write-Through via porcelain.checkout paths

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

Dulwich from 0.24.0 before 1.2.8 contains a symlink following vulnerability in porcelain.checkout(paths=[...]) that allows attackers to write arbitrary files by abusing raw os.open without O_NOFOLLOW. Attackers can craft a repository where a worktree symlink points to .git/hooks/post-checkout, so restoring the file from a tag writes a malicious hook for code execution.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

jelmer dulwich

Default version status: unaffected

  • 0.24.0 to < 1.2.8affected
  • 1.2.8unaffected
pkg:pypi/dulwich

References