GHSA-555p-6grf-mh7f · Severity: low · Ecosystem: pip — Dulwich doesn't sanitize commit subjects in `porcelain.format_patch`
Dulwich is a pure-Python implementation of the Git file formats and protocols. Starting in version 0.24.0 and prior to version 1.2.5, dulwich.porcelain.format_patch(outdir=...) derives each patch filename from the commit's subject line. Prior to this fix, get_summary only replaced spaces with dashes - path separators (/, \), parent-directory components (..), and other filename-hostile characters (e.g. :) were preserved verbatim and passed straight into os.path.join(outdir, f"{i:04d}-{summary}.patch"). A malicious commit subject could therefore direct the generated patch file outside the requested outdir. This is fixed in Dulwich 1.2.5. Users should upgrade to 1.2.5 or later. dulwich.patch.get_summary now mirrors git's format_sanitized_subject: only `[A-Za-z0-9._]` are kept, runs of other characters collapse to a single -, consecutive . collapse to a single ., trailing ./- are stripped, and the result is length-limited. This makes the returned string safe to embed as a filename component, so format_patch can no longer be steered out of outdir via the commit subject. Until upgrading, callers that pass untrusted commits to porcelain.format_patch can use stdout=True and write the patch to a destination they control, rather than letting format_patch choose the filename; validate the chosen path before opening - e.g. compare os.path.realpath(returned_path) against os.path.realpath(outdir) and reject any patch whose resolved path is not inside outdir; and/or pre-screen commits and refuse to format any whose subject's first line contains /, \, .., or other characters that are not safe on the target filesystem.
Conclusion & alert: CVE-2026-47712 is rated Low Risk (13.6/100): CVSS Low severity, with low exploitation likelihood (EPSS 0.01%). Mandatory action: Low composite risk—no urgent action required; patch on your normal maintenance cycle and revisit priority if CVSS or EPSS increases.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).
| # | Date | Old EPSS score | New EPSS score | Delta (New - Old) |
|---|---|---|---|---|
| 1 | 2026-06-11 | — | 0.01% | — |
Full EPSS history (1 record total)
CVSS metrics for this CVE.
| Base score | Version | Severity | Vector | Exploitability | Impact | Score source |
|---|---|---|---|---|---|---|
| 3.3 | 3.1 | LOW |
|
1.8 | 1.4 | [email protected] |
GHSA-555p-6grf-mh7f · Severity: low · Ecosystem: pip — Dulwich doesn't sanitize commit subjects in `porcelain.format_patch`
| vendor | priority | summary | link |
|---|---|---|---|
debian
|
not yet assigned | CVE-2026-47712 not yet assigned priority: Debian including 1 source packages (dulwich), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): open 4, resolved 1. | https://security-tracker.debian.org/tracker/CVE-2026-47712 |
redhat
|
low | — | https://access.redhat.com/security/cve/CVE-2026-47712 |
suse
|
low | — | https://www.suse.com/security/cve/CVE-2026-47712/ |
ubuntu
|
medium | CVE-2026-47712 medium priority: Ubuntu including 1 source packages (dulwich), 7 status rows across 7 suites (bionic, focal, jammy, noble, questing, resolute, upstream): needs-triage 6, released 1. | https://ubuntu.com/security/CVE-2026-47712 |
| Vendor | Product | Version | Raw CPE |
|---|---|---|---|
| No affected products in dataset. | |||