Threats Tagged 'cve-2026-42305'

Dulwich, a pure-Python Git implementation, contains a path traversal vulnerability in versions from 0.10.0 up to but not including 1.2.5. This flaw allows arbitrary file writes leading to remote code execution when cloning or checking out malicious Git repositories on Windows. The vulnerability arises because the path-element validator accepts filenames with bytes interpreted as path syntax by Windows, and certain protective configuration options were ignored due to lookup errors. POSIX systems are not directly exploitable but can propagate malicious trees to Windows users. The issue is fixed in Dulwich 1.2.5, and users should upgrade. No effective pre-patch workaround exists, and setting the ignored configuration keys does not mitigate the risk on affected versions.