Threats Tagged 'brew-poetry-ghsa-5fqc-mrg8-w798'

Dulwich's filter_branch.py in Poetry versions 2.2.0 up to but not including 2.4.2 contains a symlink directory traversal vulnerability in the CommitFilter._apply_index_filter() function. This occurs because materialized tree entries, including symlinks, persist in the working directory between commits, allowing an attacker to redirect file writes to arbitrary filesystem locations. An attacker can exploit this by crafting a malicious repository that causes filter_branch to write attacker-controlled content to arbitrary locations, potentially achieving remote code execution if writes target .git/hooks/. A fix is available that involves cleaning the working directory between commit iterations or verifying symlinks before writing files.