CVE-2026-114098
1 advisory.
PyPI/dulwich CVE-2026-114098: high 8.6
Dulwich: Symlink directory traversal in stash pop allows arbitrary file write via intermediate directory symlinks
Action: Upgrade dulwich to 1.2.8 or later.
pip install dulwich==1.2.8Affected
| introduced | fixed | last affected |
|---|---|---|
| 0.22.5 | 1.2.8 | - |
Fixed versions
| 1.2.8 |
Sources
- osv: GHSA-cm62-gvxx-vmxx
- https://github.com/jelmer/dulwich/security/advisories/GHSA-cm62-gvxx-vmxx
- https://github.com/jelmer/dulwich/commit/40a542cb02f9ac39a9eeac1193472903098698f9
- https://github.com/jelmer/dulwich
- https://github.com/jelmer/dulwich/releases/tag/dulwich-1.2.8
CVE-2026-114098 · published · modified · JSON