CVE-2026-114096: Improper Link Resolution Before File Access ('Link Following') in jelmer dulwich
Description
Dulwich versions from 0.24.0 up to but not including 1.2.8 contain a vulnerability in the porcelain.checkout function where symbolic links are improperly resolved before file access. This allows attackers to write arbitrary files by exploiting the lack of O_NOFOLLOW flag in os.open calls. Specifically, an attacker can craft a repository with a worktree symlink pointing to .git/hooks/post-checkout, causing a malicious hook to be written during a tag restore operation, potentially enabling code execution.
CVSS v4.0
Score 7.3high
Affected software
jelmer
dulwich
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in Dulwich (versions >=0.24.0 <1.2.8) involves improper handling of symbolic links in the porcelain.checkout(paths=[...]) function. The code uses raw os.open without the O_NOFOLLOW flag, allowing an attacker to abuse symlink resolution to write arbitrary files. By crafting a repository where a worktree symlink points to .git/hooks/post-checkout, the attacker can cause the restoration of a file from a tag to write a malicious Git hook, which may lead to code execution.
Potential Impact
An attacker who can supply a crafted repository can cause Dulwich to write arbitrary files, specifically malicious Git hooks, which can lead to code execution in the context of the user running Dulwich. This elevates the risk of unauthorized code execution and potential system compromise.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using vulnerable versions or avoid operations that restore files from tags in untrusted repositories. Monitor vendor communications for updates on patches.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-20T21:46:55.741Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ad80c082cdf04f6568caa4e
Added to database: 10/21/2026, 00:49:12 UTC
Last enriched: 10/21/2026, 01:18:13 UTC
Last updated: 10/21/2026, 01:28:29 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.