CVE-2026-42563

Name of the Vulnerable Software and Affected Versions Dulwich versions prior to 1.2.5-1.1

Description Command injection occurs in the ProcessMergeDriver when the file path from the git tree is substituted into the merge driver command via the %P placeholder. This command is then executed using subprocess.run(..., shell=True). An attacker can achieve arbitrary command execution by crafting malicious file paths and inducing a victim to merge an untrusted branch, provided the user has a merge driver configured that utilizes the %P placeholder.

Recommendations Update to version 1.2.5-1.1.