All vulnerabilities
CVE-2026-114096GHSA-8w8g-wq8h-fq33

Dulwich 0.24.0 before 1.2.8 Symlink Write-Through via porcelain.checkout paths

jelmer dulwichPyPILibraries & packages
Open in ThreatlineRecord JSON
CVSS
7.3High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.15%Chance of exploitation activity in the next 30 days, higher than 4% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in1.2.8Fixed versionCVE List
Published21 Oct 2026Updated 21 Oct 2026CVE List

What fixes it

  • 1.2.8dulwichCVE List
  • 1.2.8dulwich, PyPIOSVpip install "dulwich>=1.2.8"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Dulwich from 0.24.0 before 1.2.8 contains a symlink following vulnerability in porcelain.checkout(paths=[...]) that allows attackers to write arbitrary files by abusing raw os.open without O_NOFOLLOW. Attackers can craft a repository where a worktree symlink points to .git/hooks/post-checkout, so restoring the file from a tag writes a malicious hook for code execution.

Text from CVE List

Affected versions 27

  • dulwichaffected: 0.24.0 before 1.2.8CVE List
  • dulwichunaffected: 1.2.8CVE List
  • dulwich, PyPIfrom 0.24.0, fixed in 1.2.8OSV
  • dulwich, PyPI0.24.0OSV
  • dulwich, PyPI0.24.1OSV
  • dulwich, PyPI0.24.10OSV
  • dulwich, PyPI0.24.2OSV
  • dulwich, PyPI0.24.3OSV
  • dulwich, PyPI0.24.4OSV
  • dulwich, PyPI0.24.5OSV
  • dulwich, PyPI0.24.6OSV
  • dulwich, PyPI0.24.7OSV
  • dulwich, PyPI0.24.8OSV
  • dulwich, PyPI0.24.9OSV
  • dulwich, PyPI0.25.0OSV
  • dulwich, PyPI0.25.1OSV
  • dulwich, PyPI0.25.2OSV
  • dulwich, PyPI1.0.0OSV
  • dulwich, PyPI1.1.0OSV
  • dulwich, PyPI1.2.0OSV
  • dulwich, PyPI1.2.1OSV
  • dulwich, PyPI1.2.2OSV
  • dulwich, PyPI1.2.3OSV
  • dulwich, PyPI1.2.4OSV
  • dulwich, PyPI1.2.5OSV
  • dulwich, PyPI1.2.6OSV
  • dulwich, PyPI1.2.7OSV

References 2