CVE-2026-42305: Dulwich Git Implementation RCE Vulnerability

CVE-2026-42305 Overview

CVE-2026-42305 is an arbitrary file write vulnerability in Dulwich, a pure-Python implementation of the Git file formats and protocols. The flaw affects versions starting with 0.10.0 and prior to 1.2.5. Cloning, fetching, or checking out a malicious Git repository on Windows can lead to remote code execution. The root cause is insufficient validation of tree entry filenames that contain bytes Windows interprets as structural path syntax. Compounding the issue, the core.protectNTFS and core.protectHFS configuration keys were read under wrong option names, so user-set values were silently ignored. This issue is tracked under [CWE-22] (Path Traversal).

Critical Impact
Attackers can plant executable files inside .git\hooks\ via a crafted repository, achieving remote code execution when a Windows user clones or checks out the repository through Dulwich CLI, porcelain.clone, or any downstream tool built on Dulwich.

Affected Products

Dulwich versions 0.10.0 through 1.2.4 on Windows
Downstream tools and Python applications built on Dulwich
POSIX systems acting as propagators of malicious trees to Windows consumers

Discovery Timeline

Vulnerability reported by Christopher Toth
Patch released in Dulwich 1.2.5
2026-06-10 - CVE-2026-42305 published to NVD
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-42305

Vulnerability Analysis

Dulwich's validate_path_element_ntfs function failed to reject tree entry names containing Windows-specific path syntax. A malicious repository can craft tree entries such as .git\hooks\pre-commit.exe, ..\outside.txt, or .git::$INDEX_ALLOCATION. On POSIX systems, the backslash is a literal filename byte, so these entries appear benign. On Windows, the same bytes are interpreted as directory separators or alternate data stream markers. When checked out, the entries materialize files inside .git\ that Git for Windows subsequently executes, or escape the work tree entirely.

The attack chain is straightforward. An attacker publishes a repository containing a malicious tree. A Windows user clones the repository with Dulwich. Dulwich writes attacker-controlled bytes to attacker-controlled paths during checkout. If the path lands under .git\hooks\, Git for Windows executes the planted binary on the next Git operation.

Root Cause

The path validator did not reject backslash characters, colon characters used as NTFS alternate data stream markers, or NTFS 8.3 short-name aliases of .git beyond git~1. Reserved Windows device names such as CON, PRN, AUX, NUL, COM1-COM9, and LPT1-LPT9 were also accepted. Additionally, the configuration parser read core.protectNTFS and core.protectHFS under incorrect option names, silently discarding user-supplied values. Finally, core.protectNTFS only defaulted to true on Windows, whereas upstream Git has defaulted it to true everywhere since CVE-2019-1353.

Attack Vector

Exploitation requires a victim to clone, fetch, or check out an untrusted repository with Dulwich on Windows. The trigger is user-initiated (UI:R), but no authentication is required. A POSIX user can also unknowingly propagate a malicious tree to Windows consumers via push or re-publication.

python

# Source: https://github.com/jelmer/dulwich/commit/57efc4aa1581e038915a0fd79365be53b150f4a9
# Patch in dulwich/index.py - new validators added in 1.2.5

def _is_ntfs_dotgit_short_name(normalized: bytes) -> bool:
    """Match NTFS 8.3 short-name forms of ``.git`` (``git~<digits>``)."""
    if not normalized.startswith(b"git~"):
        return False
    tail = normalized[4:]
    return len(tail) > 0 and tail.isdigit()


# Reserved Windows device names. Opening any of these on Windows
# resolves to a device rather than a file, regardless of any
# extension or trailing dots/spaces (``NUL``, ``NUL.txt``,
# ``aux.foo.bar`` all hit the device).
RESERVED_WINDOWS_DEVICE_NAMES = frozenset(
    [b"con", b"prn", b"aux", b"nul"]
    + [b"com%d" % i for i in range(1, 10)]
    + [b"lpt%d" % i for i in range(1, 10)]
)


def _is_reserved_windows_device_name(normalized: bytes) -> bool:
    """Match Windows reserved device names regardless of extension."""
    # The "stem" is the portion before the first ``.``; Windows
    # also strips trailing spaces from that stem when resolving.
    stem = normalized.split(b".", 1)[0].rstrip(b" ")
    return stem in RESERVED_WINDOWS_DEVICE_NAMES

Source: Dulwich commit 57efc4aa

Detection Methods for CVE-2026-42305

Indicators of Compromise

Tree entries with filenames containing backslash (\) characters, particularly paths beginning with .git\
Filenames containing the alternate data stream marker : such as .git::$INDEX_ALLOCATION
Tree entries matching the NTFS 8.3 short-name pattern git~<digits> (e.g., git~2, git~3)
Filenames matching reserved Windows device names with or without extensions, such as NUL.txt or COM1 .bar
Unexpected files appearing under .git\hooks\ on Windows hosts after a clone or fetch

Detection Strategies

Audit Python application inventories for Dulwich versions older than 1.2.5 using pip list or equivalent dependency scanners
Inspect Git tree objects in repositories pulled from untrusted sources for filenames containing \, :, or device-name patterns
Monitor for new or modified files under any .git\hooks\ directory on Windows endpoints, particularly executables
Enable telemetry on process creation events spawned by Git for Windows hook scripts following clone or checkout operations

Monitoring Recommendations

Log all invocations of Dulwich-based tooling against external repositories, including porcelain.clone and CLI usage
Alert on Git hook executions immediately following a git clone or dulwich clone on Windows hosts
Track child process trees from Python interpreters running Dulwich for unexpected binary executions

How to Mitigate CVE-2026-42305

Immediate Actions Required

Upgrade Dulwich to version 1.2.5 or later across all environments, including CI/CD runners and developer workstations
Audit downstream tooling that bundles Dulwich and confirm those projects ship updated dependencies
Until upgraded, refrain from cloning, fetching, or checking out untrusted repositories with Dulwich on Windows
Inspect existing Windows clones of third-party repositories for unauthorized files under .git\hooks\

Patch Information

The fix is included in Dulwich 1.2.5. The patch hardens validate_path_element_ntfs to reject Windows path separators, the : alternate data stream marker, all git~<digits> 8.3 short-name aliases, and reserved Windows device names with any extension or trailing dots and spaces. core.protectNTFS now defaults to true on every platform, matching upstream Git behavior after CVE-2019-1353. Both core.protectNTFS and core.protectHFS are now read under their documented option names. See the Dulwich 1.2.5 release notes and the GHSA-897w-fcg9-f6xj advisory for full details.

Workarounds

No effective pre-patch workaround exists, because core.protectNTFS is silently ignored on vulnerable versions
Restrict Dulwich operations on Windows to trusted, internally controlled repositories only
Route clones of external repositories through a vetted, upgraded host before propagating to Windows consumers
Use Git for Windows directly instead of Dulwich for any operations involving untrusted remotes

bash

# Upgrade Dulwich to the patched version
pip install --upgrade 'dulwich>=1.2.5'

# Verify installed version
python -c "import dulwich; print(dulwich.__version__)"

# After upgrading, the NTFS validator is on by default on every platform.
# POSIX users who require literal NTFS-unsafe filenames can opt out:
git config --global core.protectNTFS false