CRITICAL9.8PyPI
GHSA-4j5j-58j7-6c3w· CVE-2014-9706, PYSEC-2015-34Dulwich Arbitrary code execution via commit with directory path starting with .git
Modified: 5/14/2026
package
PyPI/dulwich
pkg:pypi/dulwich
LOW3.3PyPI
GHSA-555p-6grf-mh7f· CVE-2026-47712, PYSEC-2026-2462Dulwich doesn't sanitize commit subjects in `porcelain.format_patch`
Modified: 7/13/2026
HIGH8.8PyPI
GHSA-897w-fcg9-f6xj· CVE-2026-42305, PYSEC-2026-2463Dulwich has an arbitrary file write via NTFS-hostile tree entries on Windows
Modified: 9/10/2026
HIGHPyPI
GHSA-9277-mp7x-85jf· CVE-2026-42563, PYSEC-2026-2464Dulwich Vulnerable to Command Injection via Merge Driver Path
Modified: 9/10/2026
CRITICAL9.8PyPI
GHSA-cwwh-4382-6fwr· CVE-2017-16228, PYSEC-2017-12Dulwich RCE Vulnerability
Modified: 11/30/2024
HIGH7.5PyPI
GHSA-gfhv-vqv2-4544· CVE-2026-52726, PYSEC-2026-2465Dulwich's submodule path traversal in porcelain.submodule_update / porcelain.clone(recurse_submodules=True) yields RCE via attacker-dropped .git/hooks payload
Modified: 7/13/2026
CRITICAL9.8PyPI
GHSA-vjjf-3rvg-gv3v· CVE-2015-0838, PYSEC-2015-35Dulwich Buffer Overflow when handling pack files
Modified: 4/14/2025
MEDIUM5.7PyPI
GHSA-xrvj-v92f-53gj· CVE-2026-47734, PYSEC-2026-2466Dulwich has unbounded memory allocation in receive-pack from crafted thin packs
Modified: 7/13/2026
—PyPI
PYSEC-2015-34· CVE-2014-9706, GHSA-4j5j-58j7-6c3wModified: 6/10/2026
—PyPI
PYSEC-2015-35· CVE-2015-0838, GHSA-vjjf-3rvg-gv3vModified: 6/10/2026
—PyPI
PYSEC-2017-12· CVE-2017-16228, GHSA-cwwh-4382-6fwrModified: 6/10/2026
LOW3.3PyPI
PYSEC-2026-2462· CVE-2026-47712, GHSA-555p-6grf-mh7fDulwich doesn't sanitize commit subjects in `porcelain.format_patch`
Modified: 7/13/2026
HIGH8.8PyPI
PYSEC-2026-2463· CVE-2026-42305, GHSA-897w-fcg9-f6xjDulwich has an arbitrary file write via NTFS-hostile tree entries on Windows
Modified: 7/13/2026
—PyPI
PYSEC-2026-2464· CVE-2026-42563, GHSA-9277-mp7x-85jfDulwich Vulnerable to Command Injection via Merge Driver Path
Modified: 7/13/2026
HIGH7.5PyPI
PYSEC-2026-2465· CVE-2026-52726, GHSA-gfhv-vqv2-4544Dulwich's submodule path traversal in porcelain.submodule_update / porcelain.clone(recurse_submodules=True) yields RCE via attacker-dropped .git/hooks payload
Modified: 7/13/2026
MEDIUM5.7PyPI
PYSEC-2026-2466· CVE-2026-47734, GHSA-xrvj-v92f-53gjDulwich has unbounded memory allocation in receive-pack from crafted thin packs
Modified: 7/13/2026