7.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-42563

CVE-2026-42563: Dulwich Vulnerable to Command Injection via Merge Driver Path

Dulwich is a pure-Python implementation of the Git file formats and protocols. Starting in version 0.24.0 and prior to version 1.2.5, Dulwich's ProcessMergeDriver substitutes the file path (from the git tree, controllable by an attacker via a malicious branch) into the merge driver command via the %P placeholder and executes it with subprocess.run(..., shell=True). An attacker who can cause a victim to merge an untrusted branch can achieve arbitrary command execution by crafting malicious file paths. Version 1.2.5 fixes the issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-42563

CVE-2026-42563:

7.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
dulwich	pip	>= 0.24.0, < 1.2.5	1.2.5

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the dulwich.merge_drivers.ProcessMergeDriver.merge method. The provided patch file, merge_drivers_shell_escape.patch, clearly shows the vulnerability and its fix. The vulnerability is a classic command injection (CWE-78) where user-controllable input (a file path from a git tree) is incorporated into a command string that is executed by the shell.

The patch introduces a new helper function, _escape_for_merge_driver, which uses shlex.quote on POSIX systems and subprocess.list2cmdline on Windows to properly sanitize the input values before they are substituted into the command string. The vulnerable code directly used cmd.replace("%P", path) without any escaping, which allowed for the injection of shell metacharacters. The fix replaces this with cmd.replace("%P", _escape_for_merge_driver(path)), effectively neutralizing the command injection vector. During exploitation, a profiler would show the ProcessMergeDriver.merge function in the call stack as it is the function that directly executes the compromised shell command.

Vulnerable functions

ProcessMergeDriver.merge

dulwich/merge_drivers.py

The `ProcessMergeDriver.merge` function constructs a command string for a git merge driver. It uses string replacement to substitute placeholders like `%P` (the file path) into the command. The `path` can be controlled by a malicious git branch. The constructed command is then executed using `subprocess.run` with `shell=True`. Before the patch, the `path` was not escaped, allowing an attacker to inject arbitrary shell commands into the merge driver command by crafting a malicious file path (e.g., 'x; touch /tmp/pwned #').

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.