CVE-2026-122299

Deferred Deferred - Pending Action

Dulwich Commit Parsing Flaw Enables Code Execution

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: VulnCheck

Description

Dulwich before 1.2.20 contains a commit object parsing vulnerability where the read path in _parse_commit resolves a duplicate tree header to the last occurrence instead of the first, diverging from core git's resolution behavior, while Poetry 2.5.1 ships this version and uses dulwich by default for git dependency installation. Attackers can craft a commit object with two tree headers so that reviewers and CI using git see a benign tree while Poetry's dulwich-based checkout resolves to a different attacker-controlled tree containing malicious build scripts such as setup.py, resulting in unreviewed code execution on the install or build host.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-11-04

Last Modified

2026-11-04

Generated

2026-11-05

AI Q&A

2026-11-05

EPSS Evaluated

N/A

NVD

CVE-2026-122299

Affected Vendors & Products

Vendor	Product	Version / Range
jelmer	dulwich	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1250	The product has or supports multiple distributed components or sub-systems that are each required to keep their own local copy of shared data - such as state or cache - but the product does not ensure that all local copies remain consistent with each other.
CWE-115	The product misinterprets an input, whether from an attacker or another product, in a security-relevant fashion.

Attack-Flow Graph

Executive Summary

Dulwich before 1.2.20 has a commit object parsing flaw where duplicate tree headers in a commit are resolved to the last occurrence instead of the first. This differs from core Git's behavior. Attackers can exploit this by creating a commit with two tree headers, making Git show a safe tree while Dulwich resolves to a malicious one containing harmful scripts like setup.py. This leads to unreviewed code execution during installation or build processes.

Impact Analysis

If you use Poetry 2.5.1 or later with Dulwich for Git dependency installation, attackers could trick you into executing malicious code during installation or build. This happens because the malicious tree with harmful scripts (e.g., setup.py) is hidden from standard Git review but exposed during Dulwich's parsing.

Mitigation Strategies

Upgrade Dulwich to version 1.2.20 or later to address the commit object parsing vulnerability. Review and update Poetry to a version that uses a patched Dulwich dependency. Inspect commit objects in repositories for duplicate tree headers as a potential indicator of exploitation.

Hi! I’m here to help you understand CVE-2026-122299. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...