{"id":"EM-20261105-G7QY","url":"https://cyber.eventmonitor.net/incident/EM-20261105-G7QY/dulwich-vulnerability-cve-2026-122299/","type":"cve","title":"Dulwich Vulnerability (CVE-2026-122299)","subtitle":"CVE-2026-122299","subject":"CVE-2026-122299","status":"Developing","severity":"high","affected":[],"headline":null,"born":"2026-11-05T00:33:07.000Z","firstSignal":"2026-11-04T23:17:23.730Z","lastSignal":"2026-11-05T00:33:07.000Z","updated":"2026-11-05T02:06:24.577Z","revision":1,"life":[{"status":"Born","at":"2026-11-05T00:33:07.000Z","why":"second independent source: C29 CIRCL Vulnerability-Lookup"},{"status":"Developing","at":"2026-11-05T00:33:07.000Z","why":"signals keep joining"}],"changeLog":[{"at":"2026-11-04T23:17:23.730Z","what":"First signal: C6 NVD CVE API 2.0"},{"at":"2026-11-05T00:33:07.000Z","what":"Born: second source, C29 CIRCL Vulnerability-Lookup. Page EM-20261105-G7QY created."}],"stages":[{"name":"Disclosed","at":"2026-11-04T23:17:23.730Z","detail":"C6 NVD published"},{"name":"Scored","at":"2026-11-04T23:17:23.730Z","detail":"CVSS 8.6"},{"name":"Exploited","at":null,"detail":"No exploitation reported"},{"name":"Advisories","at":null,"detail":"None yet"},{"name":"Vendor Response","at":null,"detail":"None in sources yet"},{"name":"Resolved","at":null,"detail":"After 14 quiet days"}],"signals":[{"at":"2026-11-04T23:17:23.730Z","source":"C6","sourceName":"NVD CVE API 2.0","role":"Database","severity":3,"title":"CVE-2026-122299 (CVSS 8.6)","text":"Dulwich before 1.2.20 contains a commit object parsing vulnerability where the read path in _parse_commit resolves a duplicate tree header to the last occurrence instead of the first, diverging from core git's resolution behavior, while Poetry 2.5.1 ships this version and uses dulwich by default for git dependency installation. Attackers can craft a commit object with two tree headers so that reviewers and CI using git see a benign tree while Poetry's dulwich-based checkout resolves to a different attacker-controlled tree containing malicious build scripts such as setup.py, resulting in unrevi","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122299"},{"at":"2026-11-05T00:33:07.000Z","source":"C29","sourceName":"CIRCL Vulnerability-Lookup","role":"Database","severity":2,"title":"GHSA-6jv4-m4h7-2vv8 / CVE-2026-122299","text":"Dulwich before 1.2.20 contains a commit object parsing vulnerability where the read path in _parse_commit resolves a duplicate tree header to the last occurrence instead of the first, diverging from core git's resolution behavior, while Poetry 2.5.1 ships this version and uses dulwich by default for","url":"https://vulnerability.circl.lu/vuln/GHSA-6jv4-m4h7-2vv8"}],"crowd":[],"reference":{"nvd":{"published":"2026-11-04T23:17:23.730","score":8.6,"severity":"HIGH","desc":"Dulwich before 1.2.20 contains a commit object parsing vulnerability where the read path in _parse_commit resolves a duplicate tree header to the last occurrence instead of the first, diverging from core git's resolution behavior, while Poetry 2.5.1 ships this version and uses dulwich by default for","product":"","seen":1793844384577},"kev":null,"epss":null,"p0":false},"mergedInto":null,"publisher":"Event Monitor Cyber"}