Threats tagged 'ghsa-6jv4-m4h7-2vv8'

Dulwich versions before 1.2.20 have a commit object parsing vulnerability where the _parse_commit function incorrectly resolves duplicate tree headers to the last occurrence instead of the first. This behavior diverges from core Git and can be exploited by attackers to craft commit objects that appear benign to Git but resolve differently in Dulwich, potentially leading to execution of malicious build scripts during dependency installation in Poetry 2.5.1, which uses Dulwich by default.