Most recent entries from all

bdu:2026-10826

BREW-breezy-CVE-2026-42563 — Dulwich Vulnerable to Command Injection via Merge Driver Path

Affected: Homebrew: breezy

## Summary

Dulwich's `ProcessMergeDriver` substitutes the file path (from the git tree, controllable by an attacker via a malicious branch) into the merge driver command via the `%P` placeholder and executes it with `subprocess.run(..., shell=True)`. An attacker who can cause a victim to merge an untrusted branch can achieve arbitrary command execution by crafting malicious file paths.

## Description

- **Type:** Command Injection - **Source:** `merge.py` line 195 — path from merge tree (from repository content when merging untrusted branch) - **Sink:** `merge_drivers.py` lines 124–127 — `subprocess.run(cmd, shell=True)` where `cmd` includes path via `%P` placeholder - **Impact:** Arbitrary code execution when merging from a malicious repository. Requires the user to have a merge driver configured that uses the `%P` placeholder.

## Resources

- Repository: https://github.com/dulwich/dulwich - Vulnerable file: `dulwich/merge_drivers.py` (lines 119–129)

## Proof of Concept

```python from dulwich.attrs import GitAttributes, Pattern from dulwich.config import ConfigDict from dulwich.merge import merge_blobs from dulwich.objects import Blob

# Merge driver with %P (path) - typical for custom merge tools config = ConfigDict() config.set((b"merge", b"injectable"), b"driver", b"echo %P > %A")

patterns = [(Pattern(b"*"), {b"merge": b"injectable"})] gitattributes = GitAttributes(patterns)

base = Blob.from_string(b"base") ours = Blob.from_string(b"ours") theirs = Blob.from_strin…

Withdrawn: CLEANSTART-2026-MI51590 — Security fixes in kserve-storage-controller 0.19.0-r0

Withdrawn by the publisher.

Affected: CleanStart: kserve-storage-controller

Package kserve-storage-controller version 0.19.0-r0 fixes 91 vulnerabilities: CVE-2024-12254, CVE-2024-12718, CVE-2024-6232, CVE-2024-7592, CVE-2024-9287...

EUVD-2026-326797

fkie_cve-2026-42563

Dulwich is a pure-Python implementation of the Git file formats and protocols. Starting in version 0.24.0 and prior to version 1.2.5, Dulwich's `ProcessMergeDriver` substitutes the file path (from the git tree, controllable by an attacker via a malicious branch) into the merge driver command via the `%P` placeholder and executes it with `subprocess.run(..., shell=True)`. An attacker who can cause a victim to merge an untrusted branch can achieve arbitrary command execution by crafting malicious file paths. Version 1.2.5 fixes the issue.

GHSA-9277-mp7x-85jf — Dulwich Vulnerable to Command Injection via Merge Driver Path

Affected: PyPI: dulwich

## Summary

## Description

## Resources

- Repository: https://github.com/dulwich/dulwich - Vulnerable file: `dulwich/merge_drivers.py` (lines 119–129)

## Proof of Concept

```python from dulwich.attrs import GitAttributes, Pattern from dulwich.config import ConfigDict from dulwich.merge import merge_blobs from dulwich.objects import Blob

# Merge driver with %P (path) - typical for custom merge tools config = ConfigDict() config.set((b"merge", b"injectable"), b"driver", b"echo %P > %A")

patterns = [(Pattern(b"*"), {b"merge": b"injectable"})] gitattributes = GitAttributes(patterns)

base = Blob.from_string(b"base") ours = Blob.from_string(b"ours") theirs = Blob.from_strin…

openSUSE-SU-2026:10900-1 — python311-dulwich-1.2.5-1.1 on GA media

python311-dulwich-1.2.5-1.1 on GA media

PYSEC-2026-2464 — Dulwich Vulnerable to Command Injection via Merge Driver Path

Affected: PyPI: dulwich

## Summary

## Description

## Resources

- Repository: https://github.com/dulwich/dulwich - Vulnerable file: `dulwich/merge_drivers.py` (lines 119–129)

## Proof of Concept

```python from dulwich.attrs import GitAttributes, Pattern from dulwich.config import ConfigDict from dulwich.merge import merge_blobs from dulwich.objects import Blob

# Merge driver with %P (path) - typical for custom merge tools config = ConfigDict() config.set((b"merge", b"injectable"), b"driver", b"echo %P > %A")

patterns = [(Pattern(b"*"), {b"merge": b"injectable"})] gitattributes = GitAttributes(patterns)

base = Blob.from_string(b"base") ours = Blob.from_string(b"ours") theirs = Blob.from_strin…

UBUNTU-CVE-2026-42563

Affected: Ubuntu:16.04:LTS: dulwich, Ubuntu:18.04:LTS: dulwich, Ubuntu:20.04:LTS: dulwich, Ubuntu:22.04:LTS: dulwich, Ubuntu:24.04:LTS: dulwich, Ubuntu:25.10: dulwich, Ubuntu:26.04:LTS: dulwich

WID-SEC-W-2026-2455 — Oracle Solaris Drittanbieterkomponenten: Mehrere Schwachstellen

Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in verschiedenen Komponenten von Drittanbietern in Oracle Solaris ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.