CVE-2026-122299 in Dulwich
Summary
by MITRE • 11/05/2026
Dulwich before 1.2.20 contains a commit object parsing vulnerability where the read path in _parse_commit resolves a duplicate tree header to the last occurrence instead of the first, diverging from core git's resolution behavior, while Poetry 2.5.1 ships this version and uses dulwich by default for git dependency installation. Attackers can craft a commit object with two tree headers so that reviewers and CI using git see a benign tree while Poetry's dulwich-based checkout resolves to a different attacker-controlled tree containing malicious build scripts such as setup.py, resulting in unreviewed code execution on the install or build host.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 11/05/2026
The vulnerability identified in versions of Dulwich prior to 1.2.20 represents a critical divergence from standard Git protocol behavior during commit object parsing, specifically within the _parse_commit function responsible for resolving tree references. In compliant Git implementations, when a commit object contains multiple tree headers, the parser is designed to recognize and utilize only the first occurrence of the tree header as the authoritative reference for the commit's root directory structure. However, Dulwich incorrectly resolves this ambiguity by selecting the last occurrence of the duplicate tree header instead. This deviation from the established standard creates a fundamental inconsistency in how repository states are interpreted between different Git tooling ecosystems, establishing a vector for supply chain attacks that exploit these parsing discrepancies.
The operational impact is particularly severe due to the widespread integration of Dulwich within Poetry version 2.5.1 and later releases as the default backend for git dependency installation. When developers or continuous integration systems review code changes in a repository using standard Git tools, they observe the state defined by the first tree header, which typically contains benign and expected source files. Conversely, when Poetry utilizes Dulwich to checkout dependencies during the build process, it resolves to the second, attacker-controlled tree header. This discrepancy allows an adversary to craft malicious commit objects that appear legitimate under visual inspection or standard review processes while silently introducing harmful artifacts into the automated build environment upon dependency resolution.
This specific attack vector facilitates unreviewed code execution on the install or build host by leveraging the trust placed in package managers and CI pipelines. An attacker can inject a setup.py file or other executable scripts within the hidden second tree, which are then executed during the installation phase without triggering security warnings from human reviewers who rely on standard Git viewers. This technique effectively bypasses traditional code review controls because the malicious payload remains invisible to manual inspection tools that adhere to core Git parsing rules. The attack aligns with CWE-20 Improper Input Validation and CWE-831 Signal Handler Error, as it exploits a failure in correctly validating and processing structured input data according to expected standards. Furthermore, this scenario is indicative of ATT&CK technique T1608 Supply Chain Compromise, where attackers manipulate trusted software distribution channels or dependency resolution mechanisms to achieve initial access and execute arbitrary code within the victim's infrastructure.
Mitigation strategies must prioritize immediate updates to Dulwich versions 1.2.20 or later, which corrects the parsing logic to align with core Git behavior by prioritizing the first tree header. Organizations relying on Poetry should verify their dependency management configurations and ensure that all instances of Dulwich are upgraded across development workstations and CI/CD pipelines. Additionally, security teams should implement strict validation policies for git dependencies in automated builds, potentially utilizing tools that enforce canonical parsing standards or perform dual-verification checks against both standard Git and alternative parsers to detect such divergences before execution occurs. Regular auditing of dependency trees and enabling integrity verification mechanisms can further reduce the risk associated with this class of vulnerability.