Live › vulnerability › CVE-2026-114094
Go to dashboardDulwich, a pure-Python Git library, does not reject Git tree entries named like DOS drive letters (such as 'C:') on Windows. A malicious repository can therefore write files outside the checkout and achieve remote code execution.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
Run pip show dulwich on Windows machines or CI runners that check out untrusted repositories and compare the version to 1.2.9.
Upgrade dulwich to 1.2.9 or later.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Dulwich before 1.2.9 fails to validate DOS drive letter prefixes in Git tree path elements on Windows, allowing arbitrary file write. Attackers can craft a malicious repository with a tree entry named 'C:' that bypasses NTFS validation and writes files outside the worktree to achieve remote code execution.
This page as .md · .json · in your agent: get_signal("CVE-2026-114094")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.