Live › vulnerability › CVE-2026-114096
Go to dashboardDulwich, a pure-Python Git implementation, follows a worktree symlink during porcelain.checkout(paths=[...]) because it opens files without O_NOFOLLOW. A crafted repository can point a symlink at .git/hooks/post-checkout, so restoring a file writes a malicious hook that runs code.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Services or tools that clone or check out Git repositories from untrusted sources using Dulwich's porcelain checkout with a paths argument are exposed, because the attacker's repository controls the symlinks. Applications that only work with repositories they create themselves, or that use Dulwich only for reading objects, are less exposed. The sources do not say whether other Dulwich APIs share the flaw.
No product ranges from the sources yet.
pip show dulwich (or check your lockfile) and see whether the version is between 0.24.0 and 1.2.8.porcelain.checkout with a paths= argument on repositories you did not create.1.2.8 or later.porcelain.checkout(paths=[...]) on untrusted repositories.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Dulwich from 0.24.0 before 1.2.8 contains a symlink following vulnerability in porcelain.checkout(paths=[...]) that allows attackers to write arbitrary files by abusing raw os.open without O_NOFOLLOW. Attackers can craft a repository where a worktree symlink points to .git/hooks/post-checkout, so restoring the file from a tag writes a malicious hook for code execution.
This page as .md · .json · in your agent: get_signal("CVE-2026-114096")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.