Poetry: Dulwich: Symlink directory traversal in filter-branch index_filter via cross-commit state persistence

The vulnerability exists in Dulwich's filter_branch.py _apply_index_filter() method, which materializes tree entries to the current working directory without cleaning up symlinked files between commits. Ancestor commit symlinks persist and can redirect writes from descendant commits to arbitrary filesystem paths. This allows an attacker to craft a repository where running filter_branch with an index filter writes attacker-controlled content to arbitrary locations, including .git/hooks/, enabling remote code execution. The root cause is that only the temporary index file is deleted, not the materialized files, and no symlink protections exist in build_file_from_blob(). The vulnerability affects Poetry versions >=2.2.0 and <2.4.2. A patch is available to clean the working directory or verify symlinks before writing.

An attacker who controls a malicious repository can cause the filter_branch operation to write arbitrary files to arbitrary filesystem locations on the victim's machine by exploiting symlink traversal. This can lead to remote code execution if the attacker writes to locations such as .git/hooks/. The vulnerability requires the victim to run filter_branch with an index filter on the malicious repository. The CVSS 3.1 score is 8.6 (high severity) indicating high impact on confidentiality, integrity, and availability.

A fix is available for this vulnerability. Users should upgrade Poetry to a patched version at or above 2.4.2 where the working directory is cleaned between commit iterations or symlink checks are implemented before writing files. Until patched, avoid running filter_branch with index filters on untrusted repositories. Follow the vendor's official update guidance to remediate this issue.