{"id":"CVE-2026-122299","kind":"vulnerability","aliases":["CVE-2026-122299"],"related":[],"title":"Dulwich: duplicate commit tree header lets Poetry install attacker-chosen code","description":"Dulwich before 1.2.20 contains a commit object parsing vulnerability where the read path in _parse_commit resolves a duplicate tree header to the last occurrence instead of the first, diverging from core git's resolution behavior, while Poetry 2.5.1 ships this version and uses dulwich by default for git dependency installation. Attackers can craft a commit object with two tree headers so that reviewers and CI using git see a benign tree while Poetry's dulwich-based checkout resolves to a different attacker-controlled tree containing malicious build scripts such as setup.py, resulting in unreviewed code execution on the install or build host.","summary":"Dulwich, a pure-Python Git library, resolves a commit object with two tree headers to the last one instead of the first, unlike core git. An attacker can make reviewers see a benign tree while Poetry's git dependency install checks out a malicious tree containing build scripts such as setup.py, which then run on the install or build host.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ci","dulwich","package","poetry","python"],"not_affected_if":["dulwich-at-1.2.20-or-later","no-git-dependencies"],"how_to_check":"- Check the installed dulwich version with `pip show dulwich` or `poetry show dulwich`, and compare it to the fixed version.\n- Check whether Poetry is in use with `poetry --version` and whether it installs git dependencies.\n- Look for `dulwich` in lockfiles and build environments.","fix":"- Dulwich: move to `1.2.20` or later.\n- Poetry 2.5.1 ships the affected dulwich version; the sources do not name a fixed Poetry release.","status":"open","published_at":"2026-11-04T23:17:23+00:00","first_seen_at":"2026-11-05T00:30:59+00:00","triaged_at":"2026-11-05T00:31:43+00:00","updated_at":"2026-11-05T00:31:43+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-05T00:31:43Z","model":"claude-haiku-5-5","output":{"fix":"- Dulwich: move to `1.2.20` or later.\n- Poetry 2.5.1 ships the affected dulwich version; the sources do not name a fixed Poetry release.","reach":"internet","title":"Dulwich: duplicate commit tree header lets Poetry install attacker-chosen code","impact":"high","summary":"Dulwich, a pure-Python Git library, resolves a commit object with two tree headers to the last one instead of the first, unlike core git. An attacker can make reviewers see a benign tree while Poetry's git dependency install checks out a malicious tree containing build scripts such as setup.py, which then run on the install or build host.","audience":"developers","category":"package","nicknames":[],"who_cares":["python","poetry","dulwich","ci"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Malicious build scripts run on the install or build host.","analyst_note":"Confirm whether Poetry's default git dependency path reaches the vulnerable read path and which Poetry release fixes it; see the vulncheck advisory.","how_to_check":"- Check the installed dulwich version with `pip show dulwich` or `poetry show dulwich`, and compare it to the fixed version.\n- Check whether Poetry is in use with `poetry --version` and whether it installs git dependencies.\n- Look for `dulwich` in lockfiles and build environments.","plain_action":"","needs_analyst":true,"not_affected_if":["no-git-dependencies","dulwich-at-1.2.20-or-later"],"who_is_affected":"Teams that install Python packages from git dependencies with Poetry, or that use dulwich directly, on build hosts or CI runners. Projects that do not install from git URLs and do not use dulwich directly are not exposed. The sources do not say whether the flaw is reachable through a package registry install alone.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000776,"input_tokens":4386,"output_tokens":675,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-122299':15A,18A '-2026':14A,17A '1.2.20':87C '2.5.1':123C 'attack':10A,51B,136C,169C 'attacker-chosen':9A 'attacker-control':168C 'base':162C 'behavior':120C 'benign':57B,155C 'build':71B,83B,174C,188C 'check':65B 'checkout':163C 'chosen':11A 'ci':19B,150C 'code':12A,182C 'commit':3A,33B,90C,100C,140C 'contain':70B,88C,172C 'control':170C 'core':48B,116C 'craft':138C 'cve':13A,16A 'default':131C 'depend':63B,134C 'differ':167C 'diverg':114C 'dulwich':1A,20B,24B,85C,129C,161C 'dulwich-bas':160C 'duplic':2A,103C 'execut':183C 'first':46B,113C 'git':29B,49B,62B,117C,133C,152C 'header':5A,38B,105C,145C 'host':84B,189C 'instal':8A,64B,81B,135C,186C 'instead':43B,110C 'last':41B,108C 'let':6A 'librari':30B 'make':53B 'malici':68B,173C 'object':34B,91C,141C 'occurr':109C 'one':42B 'packag':21B 'pars':92C,99C 'path':97C 'poetri':7A,22B,60B,122C,158C 'pure':27B 'pure-python':26B 'python':23B,28B 'read':96C 'resolut':119C 'resolv':31B,101C,164C 'result':179C 'review':54B,148C 'run':78B 'script':72B,175C 'see':55B,153C 'setup.py':75B,178C 'ship':124C 'tree':4A,37B,58B,69B,104C,144C,156C,171C 'two':36B,143C 'unlik':47B 'unreview':181C 'use':128C,151C 'version':126C 'vulner':93C","nicknames":[],"mitigations":[],"who_affected":"Teams that install Python packages from git dependencies with Poetry, or that use dulwich directly, on build hosts or CI runners. Projects that do not install from git URLs and do not use dulwich directly are not exposed. The sources do not say whether the flaw is reachable through a package registry install alone.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ci","dulwich","high","package","poetry","python"],"campaign_type":null,"first_public_at":"2026-11-04T23:17:23+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-122299","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122299","severity":null,"published_at":"2026-11-04T23:17:23+00:00","modified_at":"2026-11-04T23:17:23+00:00","first_seen_at":"2026-11-05T00:30:59+00:00","fetched_at":"2026-11-05T00:30:59+00:00","note":null}],"documents":[{"id":71460,"url":"https://github.com/jelmer/dulwich/commit/b77f385b4b0d2d2c7f5ac39dae628948f7ad3a96","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":71461,"url":"https://github.com/jelmer/dulwich/releases/tag/dulwich-1.2.20","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":71462,"url":"https://www.vulncheck.com/advisories/dulwich-before-commit-parser-tree-header-misinterpretation","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}