---
id: "CVE-2026-122299"
kind: "vulnerability"
aliases: ["CVE-2026-122299"]
title: "Dulwich: duplicate commit tree header lets Poetry install attacker-chosen code"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["ci", "dulwich", "package", "poetry", "python"]
not_affected_if: ["dulwich-at-1.2.20-or-later", "no-git-dependencies"]
published_at: "2026-11-04T23:17:23+00:00"
first_seen_at: "2026-11-05T00:30:59+00:00"
updated_at: "2026-11-05T00:31:43+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-122299", "first_seen_at": "2026-11-05T00:30:59+00:00"}]
exploit_sources: []
---

# Dulwich: duplicate commit tree header lets Poetry install attacker-chosen code

Dulwich, a pure-Python Git library, resolves a commit object with two tree headers to the last one instead of the first, unlike core git. An attacker can make reviewers see a benign tree while Poetry's git dependency install checks out a malicious tree containing build scripts such as setup.py, which then run on the install or build host.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed dulwich version with `pip show dulwich` or `poetry show dulwich`, and compare it to the fixed version.
- Check whether Poetry is in use with `poetry --version` and whether it installs git dependencies.
- Look for `dulwich` in lockfiles and build environments.

## Fix

- Dulwich: move to `1.2.20` or later.
- Poetry 2.5.1 ships the affected dulwich version; the sources do not name a fixed Poetry release.

## Timeline

- 2026-11-05T00:30:59+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-122299

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/dulwich-before-commit-parser-tree-header-misinterpretation
- [fix] Patch: github.com https://github.com/jelmer/dulwich/commit/b77f385b4b0d2d2c7f5ac39dae628948f7ad3a96
- [fix] Release notes: github.com https://github.com/jelmer/dulwich/releases/tag/dulwich-1.2.20

## From the sources

Dulwich before 1.2.20 contains a commit object parsing vulnerability where the read path in _parse_commit resolves a duplicate tree header to the last occurrence instead of the first, diverging from core git's resolution behavior, while Poetry 2.5.1 ships this version and uses dulwich by default for git dependency installation. Attackers can craft a commit object with two tree headers so that reviewers and CI using git see a benign tree while Poetry's dulwich-based checkout resolves to a different attacker-controlled tree containing malicious build scripts such as setup.py, resulting in unreviewed code execution on the install or build host.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_