Threats tagged 'brew-conda-lock-cve-2026-42563'

Dulwich's merge driver functionality is vulnerable to command injection via the %P placeholder in merge driver commands. An attacker who can cause a victim to merge an untrusted branch with malicious file paths can execute arbitrary commands. This requires the victim to have a merge driver configured that uses the %P placeholder. The vulnerability affects conda-lock versions from 4.0.0 up to but not including 4.0.5 and is fixed in version 4.0.5.