Advisory · CVE-2026-122299
Dulwich commit parsing can show reviewers one tree and install another
Dulwich before 1.2.20 resolves a duplicate tree header in a commit object to the last occurrence instead of the first, diverging from core git. Poetry 2.5.1 ships this version and uses dulwich by default, so a crafted commit can make reviewers see a benign tree while Poetry installs a malicious one. Dulwich rates it CVSS 3.1 8.8.
- Vendor
- Dulwich
- Product
- Dulwich
- Identifier / CWE
- CVE-2026-122299
CWE-115, CWE-1250 - Action timing
- Immediate
Explain it like I’m five
Git and Dulwich read the same commit but disagree about which tree it points to. Reviewers see the safe version; the installer gets the attacker's version.
- 01Crafted commit published
An attacker crafts a commit object with two tree headers.
- 02Reviewers see the benign tree
Reviewers and CI using core git resolve the first tree header and see benign content.
- 03Dulwich resolves the other tree
Poetry's dulwich-based checkout resolves the last tree header to an attacker-controlled tree.
- 04Malicious code runs
The attacker-controlled tree contains malicious build scripts such as setup.py, which run on install or build.
What happened
Dulwich disclosed CVE-2026-122299 for Dulwich before 1.2.20. The commit object parser resolves a duplicate tree header to the last occurrence instead of the first, diverging from core git’s behavior. Poetry 2.5.1 ships this version and uses dulwich by default for git dependency installation, so an attacker can craft a commit object with two tree headers: reviewers and CI using git see a benign tree while Poetry’s dulwich-based checkout resolves a different attacker-controlled tree containing malicious build scripts such as setup.py, resulting in unreviewed code execution on install or build.
The advisory rates it CVSS 3.1 8.8 and identifies Dulwich 1.2.20 as the fixed release.
What to do
- Upgrade Dulwich to 1.2.20 or later, and upgrade Poetry installations that bundle the affected version.
- Re-review git dependencies installed from untrusted or recently changed repositories during the exposure window.
- Check build and install logs for setup.py execution from git dependencies that were not in the reviewed tree.
- Treat any package installed from a crafted commit as compromised and rebuild from a verified source.
Management note
This is a supply-chain flaw where the review step and the install step disagree about what was reviewed. The fix is a parser patch, but the real lesson is that the two tools must resolve the same commit the same way.