{"id":"CVE-2026-42563","title":"dulwich: Dulwich: Arbitrary code execution via malicious Git file paths during merge (CVE-2026-42563)","summary":"A flaw was found in Dulwich, a pure-Python implementation of Git file formats and protocols. An attacker can exploit this vulnerability by crafting malicious file paths within an untrusted Git branch. When a victim merges this branch, the …","severity":"high","cvss":8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","cvssSource":"vendor","cwe":"CWE-78","vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2","affected":["ansible_automation_platform 2","openshift_ai_rhoai"],"patched":["dulwich 1.2.5"],"published":"2026-06-10","updated":"2026-10-16","sourceUpdated":"2026-10-16T11:16:31+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42563.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42563.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-42563"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2487751"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42563"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42563"},{"url":"https://github.com/jelmer/dulwich/commit/e3331b3b3a122fc313460182f928f59723580b7b"},{"url":"https://github.com/jelmer/dulwich/releases/tag/dulwich-1.2.5"},{"url":"https://github.com/jelmer/dulwich/security/advisories/GHSA-9277-mp7x-85jf"},{"url":"https://github.com/jelmer/dulwich"}],"tags":["csaf","vex","red-hat","osv","pip"],"epss":0.00555,"epssPercentile":0.46115,"aliases":["GHSA-9277-mp7x-85jf","PYSEC-2026-2464"],"ecosystem":"pip","ingestedAt":"2026-07-13T18:57:55.637Z","slug":"CVE-2026-42563","body":"## Overview\n\nA flaw was found in Dulwich, a pure-Python implementation of Git file formats and protocols. An attacker can exploit this vulnerability by crafting malicious file paths within an untrusted Git branch. When a victim merges this branch, the ProcessMergeDriver component incorrectly substitutes the attacker-controlled file path into a command, leading to arbitrary code execution. This allows the attacker to run unauthorized commands on the victim's system.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Important · affected: Red Hat Ansible Automation Platform 2, Red Hat OpenShift AI (RHOAI) · no fix planned: Red Hat Ansible Automation Platform 2, Red Hat OpenShift AI (RHOAI) · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42563.json)\n\n**dulwich: Dulwich: Arbitrary code execution via malicious Git file paths during merge** — rated Important by Red Hat. Released 2026-06-10, updated 2026-10-16.\n\nAffected:\n\n- Red Hat Ansible Automation Platform 2\n- Red Hat OpenShift AI (RHOAI)\n\nNo fix planned:\n\n- Red Hat Ansible Automation Platform 2\n- Red Hat OpenShift AI (RHOAI)\n\nNot affected:\n\n- Red Hat Ansible Automation Platform 2\n- Red Hat Enterprise Linux 7\n- Red Hat Enterprise Linux 8\n- Red Hat OpenShift AI (RHOAI)\n- Red Hat OpenShift Container Platform 4\n- Red Hat Satellite 6\n\n## Remediation\n\nAffected\n\nWorkarounds / mitigations:\n\n- Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.\n\n## Package advisory (CVE-2026-42563)\n\nAffected packages:\n\n- `dulwich >= 0.24.0, < 1.2.5`\n\nPatched in:\n\n- `dulwich 1.2.5`\n\nSource: https://osv.dev/vulnerability/GHSA-9277-mp7x-85jf","depth":"twilight","depthScore":44,"depthScoreParts":{"impact":44,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":210680,"id":"CVE-2026-42563","ts":1790322178252,"field":"cvss","old":null,"new":"8"}]}