CVE-2026-122299

    Dashboard / Vulnerabilities / CVE-2026-122299

    CVE-2026-122299

    Published: 4 Nov 2026Last Modified: 5 Nov 2026

    Summary: Dulwich before 1.2.20 Commit Parser Tree Header Misinterpretation

    Details: Dulwich before 1.2.20 contains a commit object parsing vulnerability where the read path in _parse_commit resolves a duplicate tree header to the last occurrence instead of the first, diverging from core git's resolution behavior, while Poetry 2.5.1 ships this version and uses dulwich by default for git dependency installation. Attackers can craft a commit object with two tree headers so that reviewers and CI using git see a benign tree while Poetry's dulwich-based checkout resolves to a different attacker-controlled tree containing malicious build scripts such as setup.py, resulting in unreviewed code execution on the install or build host.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/122xxx/CVE-2026-122299.json, https://nvd.nist.gov/vuln/detail/CVE-2026-122299, https://www.vulncheck.com/advisories/dulwich-before-commit-parser-tree-header-misinterpretation, https://github.com/jelmer/dulwich/commit/b77f385b4b0d2d2c7f5ac39dae628948f7ad3a96, https://github.com/jelmer/dulwich/releases/tag/dulwich-1.2.20, https://github.com/jelmer/dulwich

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -de652805b35611192a8f771fec393ad74b056136

    Affected versions

    dulwich-1.2.19
    dulwich-1.2.18
    dulwich-1.2.17
    dulwich-1.2.16
    dulwich-1.2.15
    dulwich-1.2.14
    dulwich-1.2.13
    dulwich-1.2.12
    dulwich-1.2.11
    dulwich-1.2.10
    dulwich-1.2.9
    dulwich-1.2.8
    dulwich-1.2.7
    dulwich-1.2.6
    dulwich-1.2.5
    dulwich-1.2.4
    dulwich-1.2.3
    dulwich-1.2.2
    dulwich-1.2.1
    dulwich-1.2.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-122299 | CVE-DB