{"action":"Upgrade dulwich to 1.2.8 or later.","affected":[{"fixed":"1.2.8","introduced":"0.22.5"}],"component":"dulwich","cve_ids":["CVE-2026-114098"],"ecosystem":"PyPI","exploited":false,"fixed_versions":["1.2.8"],"ghsa_id":"GHSA-cm62-gvxx-vmxx","id":"tcs_01M5JK9RWEW587RRDWZDN4DBEX","modified_at":"2026-10-21T10:57:23.057449524Z","published_at":"2026-10-02T18:52:53Z","references":["https://osv.dev/vulnerability/GHSA-cm62-gvxx-vmxx","https://github.com/jelmer/dulwich/security/advisories/GHSA-cm62-gvxx-vmxx","https://github.com/jelmer/dulwich/commit/40a542cb02f9ac39a9eeac1193472903098698f9","https://github.com/jelmer/dulwich","https://github.com/jelmer/dulwich/releases/tag/dulwich-1.2.8"],"severity":{"label":"high","score":8.6},"sources":[{"source":"osv","source_id":"GHSA-cm62-gvxx-vmxx","url":"https://osv.dev/vulnerability/GHSA-cm62-gvxx-vmxx"}],"summary":"Dulwich: Symlink directory traversal in stash pop allows arbitrary file write via intermediate directory symlinks"}