Bug 2487751 (CVE-2026-42563)

Summary: CVE-2026-42563 dulwich: Dulwich: Arbitrary code execution via malicious Git file paths during merge
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: akhatavk, anthomas, aos-team-art-private, asdas, dpaolell, dschmidt, ehelms, erezende, gbenhaim, ggainey, jdelft, jdobes, jkoehler, jlanda, jpasqual, jupierce, juwatts, kgaikwad, kshier, lgarciaa, lphiri, mbiarnes, mdellweg, mhulan, niyer, nmoumoul, orabin, osousa, pcreech, ppalepu, ppostler, prdhamdh, rchan, rhel-process-autobot, sghai, sidsharm, simaishi, smallamp, smcdonal, stcannon, suppawar, teagle, tmalecek, twaugh, vlaad, watson-tool-maintainers, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Dulwich, a pure-Python implementation of Git file formats and protocols. An attacker can exploit this vulnerability by crafting malicious file paths within an untrusted Git branch. When a victim merges this branch, the ProcessMergeDriver component incorrectly substitutes the attacker-controlled file path into a command, leading to arbitrary code execution. This allows the attacker to run unauthorized commands on the victim's system.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-06-10 23:01:23 UTC 
Dulwich is a pure-Python implementation of the Git file formats and protocols. Starting in version 0.24.0 and prior to version 1.2.5, Dulwich's `ProcessMergeDriver` substitutes the file path (from the git tree, controllable by an attacker via a malicious branch) into the merge driver command via the `%P` placeholder and executes it with `subprocess.run(..., shell=True)`. An attacker who can cause a victim to merge an untrusted branch can achieve arbitrary command execution by crafting malicious file paths. Version 1.2.5 fixes the issue.