PyPI/dulwich CVE-2026-114097: high 8.6
Dulwich: Symlink directory traversal in filter-branch index_filter via cross-commit state persistence
Action: Upgrade dulwich to 1.2.8 or later.
pip install dulwich==1.2.8Affected
| introduced | fixed | last affected |
|---|---|---|
| 0.23.1 | 1.2.8 | - |
Fixed versions
| 1.2.8 |
Sources
- osv: GHSA-5fqc-mrg8-w798
- https://github.com/jelmer/dulwich/security/advisories/GHSA-5fqc-mrg8-w798
- https://github.com/jelmer/dulwich/commit/9571ac60b851fce228dae7ededb380c6ce9b3fb8
- https://github.com/jelmer/dulwich
- https://github.com/jelmer/dulwich/releases/tag/dulwich-1.2.8
CVE-2026-114097 · published · modified · JSON