CVE-2026-42563 Overview
CVE-2026-42563 is a command injection vulnerability in Dulwich, a pure-Python implementation of the Git file formats and protocols. The flaw affects versions 0.24.0 through 1.2.4 and resides in the ProcessMergeDriver component. Dulwich substitutes the file path from the Git tree into a merge driver command via the %P placeholder and executes it with subprocess.run(..., shell=True). Because the file path is attacker-controllable through a malicious branch, an attacker who convinces a victim to merge an untrusted branch can achieve arbitrary command execution. Version 1.2.5 fixes the issue.
Critical Impact
Arbitrary OS command execution on the developer or build system that merges a malicious branch using a configured ProcessMergeDriver.
Affected Products
- Dulwich versions 0.24.0 through 1.2.4
- Applications and tooling that embed Dulwich and use ProcessMergeDriver
- Automation, CI/CD, and developer workstations that merge untrusted branches via Dulwich
Discovery Timeline
- 2026-06-10 - CVE CVE-2026-42563 published to NVD
- 2026-06-10 - Last updated in NVD database
Technical Details for CVE-2026-42563
Vulnerability Analysis
The vulnerability is an OS command injection issue tracked under [CWE-78]. Dulwich exposes a ProcessMergeDriver that invokes an external merge driver configured by the user. When constructing the command line, Dulwich substitutes the %P placeholder with the file path taken from the Git tree being merged. The resulting string is then passed to subprocess.run with shell=True, which invokes a shell to parse and execute the command. Because the path comes from tree entries inside a Git branch, an attacker who controls a remote branch controls the value substituted into the command.
Root Cause
The root cause is unsanitized substitution of untrusted input into a shell command string. File paths inside Git trees can contain arbitrary bytes, including shell metacharacters such as ;, &&, |, backticks, and $(). Combining %P substitution with shell=True allows those metacharacters to break out of the intended argument and execute attacker-supplied commands.
Attack Vector
Exploitation requires that a victim merge an attacker-controlled branch using Dulwich with a configured ProcessMergeDriver. The attacker crafts a branch containing a file whose path embeds shell metacharacters and a payload. When the merge runs, Dulwich expands %P into the malicious path and the shell executes the embedded command under the victim's user context. This is a network attack vector with user interaction, since the victim must initiate the merge.
No verified public exploit code is available. See the GitHub Security Advisory GHSA-9277 and the GitHub Commit e3331b3 for technical details of the fix.
Detection Methods for CVE-2026-42563
Indicators of Compromise
- Unexpected child processes spawned by Python processes running Dulwich during merge operations.
- Shell processes (/bin/sh -c, cmd.exe /c) invoked with arguments containing file paths that include metacharacters such as ;, |, &&, or $().
- Outbound network connections initiated from CI/CD runners or developer machines immediately following a Git merge.
Detection Strategies
- Inventory Python environments and identify installations of Dulwich older than 1.2.5 using pip show dulwich or SBOM tooling.
- Audit Git configurations for custom merge drivers referencing the %P placeholder.
- Hunt for process trees where a Python interpreter spawns a shell that spawns unexpected binaries during Git operations.
Monitoring Recommendations
- Log and review process creation events (Sysmon Event ID 1, Linux auditd execve) on build agents and developer endpoints.
- Alert on Dulwich-driven merges of branches sourced from untrusted forks or external contributors.
- Forward Git server and CI logs to a central analytics pipeline to correlate merge events with downstream process and network anomalies.
How to Mitigate CVE-2026-42563
Immediate Actions Required
- Upgrade Dulwich to version 1.2.5 or later across all environments, including CI/CD runners and developer workstations.
- Audit repositories and configurations for custom merge drivers using the %P placeholder and disable them until upgrade is complete.
- Restrict merging of branches from untrusted contributors until patched versions are deployed.
Patch Information
The issue is fixed in Dulwich 1.2.5. Refer to the GitHub Release dulwich-1.2.5 and the corresponding fix in GitHub Commit e3331b3. The patch removes the unsafe shell-based substitution path so attacker-controlled file paths cannot be interpreted as shell syntax.
Workarounds
- Avoid configuring ProcessMergeDriver until Dulwich is upgraded to 1.2.5 or later.
- Use Git's native merge drivers or alternative tooling for merges that involve branches from untrusted sources.
- Run merge operations inside ephemeral, network-restricted sandboxes such as disposable containers to limit blast radius.
# Configuration example
pip install --upgrade 'dulwich>=1.2.5'
pip show dulwich | grep -i version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
