CVE-2026-42563

A flaw was found in Dulwich, a pure-Python implementation of Git file formats and protocols. An attacker can exploit this vulnerability by crafting malicious file paths within an untrusted Git branch. When a victim merges this branch, the ProcessMergeDriver component incorrectly substitutes the attacker-controlled file path into a command, leading to arbitrary code execution. This allows the attacker to run unauthorized commands on the victim's system.

This is an Important command injection flaw in Dulwich, a Git file format and protocol implementation. The vulnerability allows arbitrary code execution when a user merges a malicious Git branch, provided a merge driver is configured to use the %P placeholder. This elevates the risk to Important due to the potential for full system compromise, although it requires specific user interaction and configuration.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.