Threats tagged 'brew-conda-lock-cve-2026-42305'

CVE-2026-42305 is a high-severity vulnerability in Dulwich used by conda-lock on Windows that allows arbitrary file write and remote code execution when cloning or checking out a malicious Git repository. The flaw arises from Dulwich's path-element validator accepting filenames containing bytes interpreted by Windows as path syntax, enabling attackers to plant files inside the victim's .git directory or escape the working tree. This can lead to execution of malicious Git hooks. The issue is fixed in Dulwich 1.2.5 and conda-lock 4.0.5. No effective workaround exists other than upgrading or avoiding untrusted repositories on Windows.