CVE-2026-122299 (CVSS 8.8)

Description

Dulwich before 1.2.20 contains a commit object parsing vulnerability where the read path in _parse_commit resolves a duplicate tree header to the last occurrence instead of the first, diverging from core git's resolution behavior, while Poetry 2.5.1 ships this version and uses dulwich by default for git dependency installation. Attackers can craft a commit object with two tree headers so that reviewers and CI using git see a benign tree while Poetry's dulwich-based checkout resolves to a different attacker-controlled tree containing malicious build scripts such as setup.py, resulting in unreviewed code execution on the install or build host.

Is your site exposed to CVE-2026-122299?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

8.8

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS — Exploit Prediction

0.0033

Probability of exploitation

0.26%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

Weakness Type (CWE)

CWE-115 CWE-115

CWE-1250 CWE-1250

References

Other References

https://github.com/jelmer/dulwich/commit/b77f385b4b0d2d2c7f5ac39dae628948f7ad3a96 https://github.com/jelmer/dulwich/releases/tag/dulwich-1.2.20 https://www.vulncheck.com/advisories/dulwich-before-commit-parser-tree-header-misinterpretation

Frequently Asked Questions

What is CVE-2026-122299? +

Dulwich before 1.2.20 contains a commit object parsing vulnerability where the read path in _parse_commit resolves a duplicate tree header to the last occurrence instead of the first, diverging from core git's resolution behavior, while Poetry 2.5.1 ships this version and uses dulwich by default for git dependency installation. Attackers can craft a commit object with two tree headers so that reviewers and CI using git see a benign tree while Poetry's dulwich-based checkout resolves to a different attacker-controlled tree containing malicious build scripts such as setup.py, resulting in unreviewed code execution on the install or build host. It has a CVSS v3.1 base score of 8.8 (HIGH).

How severe is CVE-2026-122299? +

CVE-2026-122299 has a CVSS v3.1 score of 8.8 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching. The EPSS score is 0.0033, placing it in the 0th percentile for exploitation probability.

How do I check if I'm vulnerable to CVE-2026-122299? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-17566 9.9

pgAdmin 4's Import/Export Data tool builds a psql \copy (...) command line by interpolating a user-supplied SQL query into a …

CVE-2026-116241 9.9

pgAdmin 4's Import/Export Data tool wraps a user's query export in a psql \copy (...) TO command and checks that …

CVE-2026-17351 9.0

The fix for CVE-2026-12045 in pgAdmin 4 9.16 required the LLM-supplied query passed to the AI Assistant's execute_sql_query tool to …

CVE-2026-73798 8.2

A security vulnerability in HPE NonStop DNS 9.2.3 Non Secure Version could cause a Denial of Service.

CVE-2025-5747 8.0

WOLFBOX Level 2 EV Charger MCU Command Parsing Misinterpretation of Input Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers …

CVE-2024-11169 7.5

An unhandled exception in danny-avila/librechat version 3c94ff2 can lead to a server crash. The issue occurs when the fs module …