CVE-2026-42563

Name	CVE-2026-42563
Description	Dulwich is a pure-Python implementation of the Git file formats and protocols. Starting in version 0.24.0 and prior to version 1.2.5, Dulwich's `ProcessMergeDriver` substitutes the file path (from the git tree, controllable by an attacker via a malicious branch) into the merge driver command via the `%P` placeholder and executes it with `subprocess.run(..., shell=True)`. An attacker who can cause a victim to merge an untrusted branch can achieve arbitrary command execution by crafting malicious file paths. Version 1.2.5 fixes the issue.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
dulwich (PTS)	bullseye	0.20.15-1	vulnerable
	bookworm	0.21.2-1	vulnerable
	trixie	0.22.7-1	vulnerable
	forky	1.2.1-1	vulnerable
	sid	1.2.7-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
dulwich	source	(unstable)	1.2.5-1

Notes

https://github.com/jelmer/dulwich/security/advisories/GHSA-9277-mp7x-85jf
https://github.com/jelmer/dulwich/commit/0110b885a1ab5b2128473263a6ff5b7230732e49 (dulwich-1.2.5)