CVE-2026-114096
1 advisory.
PyPI/dulwich CVE-2026-114096: high 8.6
Dulwich: Symlink write-through in checkout(paths=[]) via raw os.open bypasses all symlink protections
Action: Upgrade dulwich to 1.2.8 or later.
pip install dulwich==1.2.8Affected
| introduced | fixed | last affected |
|---|---|---|
| 0.24.0 | 1.2.8 | - |
Fixed versions
| 1.2.8 |
Sources
- osv: GHSA-8w8g-wq8h-fq33
- https://github.com/jelmer/dulwich/security/advisories/GHSA-8w8g-wq8h-fq33
- https://github.com/jelmer/dulwich/commit/9389fcb5cb9113adfc7f207d8be86a56904db3e8
- https://github.com/jelmer/dulwich
- https://github.com/jelmer/dulwich/releases/tag/dulwich-1.2.8
CVE-2026-114096 · published · modified · JSON