Threats tagged 'brew-conda-lock-cve-2026-47712'

A vulnerability in dulwich.porcelain.format_patch allows malicious commit subjects to cause patch files to be written outside the intended output directory. This occurs because commit subjects are used directly in patch filenames without proper sanitization, permitting directory traversal and illegal filename characters. The issue is fixed in Dulwich version 1.2.5. Users should upgrade to prevent potential unauthorized file writes.