CVE-2026-114096

Name of the Vulnerable Software and Affected Versions Dulwich versions 0.24.0 through 1.2.7

Description A symlink following issue exists in the porcelain.checkout(paths=[...]) function. The software uses os.open without the O NOFOLLOW flag, which allows it to follow symlinks at the target file and intermediate directories. An attacker can craft a malicious repository containing a symlink that points to a sensitive location, such as .git/hooks/post-checkout. When a user restores a file from a tag using the affected function, the software may write attacker-controlled content to that location, potentially leading to remote code execution (RCE) when the hook is triggered.

Recommendations Update Dulwich to version 1.2.8 or later. As a temporary workaround, restrict the use of the porcelain.checkout(paths=[...]) function when dealing with untrusted repositories.