Vulnerabilities for dulwich

First version without a known vulnerability: 1.2.5

Details

• GHSA-gfhv-vqv2-45442026-07-02

  Dulwich's submodule path traversal in porcelain.submodule_update / porcelain.clone(recurse_submodules=True) yields RCE via attacker-dropped .git/hooks payload

  Fixed in: 1.2.5

• GHSA-xrvj-v92f-53gj2026-06-08

  Dulwich has unbounded memory allocation in receive-pack from crafted thin packs

  Fixed in: 1.2.5

• GHSA-555p-6grf-mh7f2026-06-08

  Dulwich doesn't sanitize commit subjects in `porcelain.format_patch`

  Fixed in: 1.2.5

• GHSA-9277-mp7x-85jf2026-05-28

  Dulwich Vulnerable to Command Injection via Merge Driver Path

  Fixed in: 1.2.5

• GHSA-897w-fcg9-f6xj2026-05-28

  Dulwich has an arbitrary file write via NTFS-hostile tree entries on Windows

  Fixed in: 1.2.5

• GHSA-vjjf-3rvg-gv3v2022-05-17

  Dulwich Buffer Overflow when handling pack files

  Fixed in: 0.9.9

• GHSA-4j5j-58j7-6c3w2022-05-17

  Dulwich Arbitrary code execution via commit with directory path starting with .git

  Fixed in: 0.9.10, 0.9.9

• GHSA-cwwh-4382-6fwr2022-05-13

  Dulwich RCE Vulnerability

  Fixed in: 0.18.5