Jelmer vulnerabilities
We track 8 vulnerabilities in Jelmer products. 8 are rated high or critical, and none are known to be exploited. The most recent was published on November 4, 2026.
Latest Jelmer vulnerabilities
- 8.8 High severity
dulwich: Misinterpretation of Input
Dulwich before 1.2.20 contains a commit object parsing vulnerability where the read path in _parse_commit resolves a duplicate tree header to the last occurrence instead of the first, diverging from core git's resolution behavior, while Poetry 2.5.1 ships this
- 7.8 High severity
dulwich: Improper Limitation of a Pathname to a Restricted Directory
Dulwich from 0.22.5 before 1.2.8 contains a path traversal vulnerability in stash.py pop() that allows attackers to write arbitrary files outside the worktree through intermediate directory symlinks. Attackers can craft a malicious repository whose popped stas
- 7.8 High severity
dulwich: Improper Limitation of a Pathname to a Restricted Directory
Dulwich from 0.23.1 before 1.2.8 contains a path traversal vulnerability in CommitFilter._apply_index_filter() that allows attackers to write files outside the working directory via symlinks persisting between commits. Attackers can craft a repository where an
- 7.8 High severity
dulwich: Improper Link Resolution Before File Access
Dulwich from 0.24.0 before 1.2.8 contains a symlink following vulnerability in porcelain.checkout(paths=[...]) that allows attackers to write arbitrary files by abusing raw os.open without O_NOFOLLOW. Attackers can craft a repository where a worktree symlink p
- 8.8 High severity
dulwich: Improper Limitation of a Pathname to a Restricted Directory
Dulwich before 1.2.9 fails to validate DOS drive letter prefixes in Git tree path elements on Windows, allowing arbitrary file write. Attackers can craft a malicious repository with a tree entry named 'C:' that bypasses NTFS validation and writes files outside
- 7.5 High severity
dulwich: Improper Limitation of a Pathname to a Restricted Directory
Dulwich is a pure-Python implementation of the Git file formats and protocols. Starting in version 0.23.2 and prior to version 1.2.5, `dulwich.porcelain.submodule_update`, and by extension `porcelain.clone(..., recurse_submodules=True)`, materializes attacker-
- 7.7 High severity
dulwich: Improper Neutralization of Special Elements used in an OS Command
Dulwich is a pure-Python implementation of the Git file formats and protocols. Starting in version 0.24.0 and prior to version 1.2.5, Dulwich's `ProcessMergeDriver` substitutes the file path (from the git tree, controllable by an attacker via a malicious branc
- 8.8 High severity
dulwich: Improper Limitation of a Pathname to a Restricted Directory
Dulwich is a pure-Python implementation of the Git file formats and protocols. Versions starting with 0.10.0 and prior to 1.2.5 have an arbitrary file write leading to remote code execution when cloning or checking out a malicious Git repository on Windows. Du