Read the docs

jelmer

Records11All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high9CVSS 7.0–8.9

Exploited now

jelmer records in CISA KEV

No jelmer vulnerabilities are listed in CISA KEV.

Records

11 records

TI-2026-37846 CVE-2026-52726 · GHSA-gfhv-vqv2-4544

Path traversal in jelmer dulwich

Priority HIGH 72

Dulwich is a pure-Python implementation of the Git file formats and protocols.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00448 Published 2026-06-10 Partial fix · 1.2.5 CWE-22
TI-2026-78709 CVE-2026-114096

Symlink following in Dulwich checkout allows arbitrary file writes

Priority HIGH 67

Dulwich from 0.24.0 before 1.2.8 contains a symlink following vulnerability in porcelain.checkout(paths=[...]) that allows attackers to write arbitrary files by abusing raw os.open without O_NOFOLLOW.

CVSS 4.0HIGH 7.3 Local No auth User interaction EPSS 0.00155 Published 2026-10-21 Partial fix · 1.2.8 CWE-59
TI-2026-85266 CVE-2026-122299 · GHSA-6jv4-m4h7-2vv8

Dulwich commit parser picks the wrong tree from duplicate headers

Priority LOW 37

Dulwich before 1.2.20 contains a commit object parsing vulnerability where the read path in _parse_commit resolves a duplicate tree header to the last occurrence instead of the first, diverging from core git's resolution…

CVSS 4.0HIGH 8.6 Network No auth User interaction EPSS 0.00325 Published 2026-11-04 Partial fix · 1.2.20 CWE-115
TI-2026-78708 CVE-2026-114095

Infinite recursion in Dulwich pack parsing causes denial of service

Priority LOW 37

Dulwich before 1.2.9 contains a denial of service vulnerability in Pack.resolve_object that allows attackers to cause infinite recursion via self-referential OFS_DELTA objects.

CVSS 4.0HIGH 7.1 Network No auth User interaction EPSS 0.00311 Published 2026-10-21 Partial fix · 1.2.9 CWE-835
TI-2026-78711 CVE-2026-114098

Dulwich Path Traversal via Stash Pop Symlinks

Priority LOW 33

Dulwich from 0.22.5 before 1.2.8 contains a path traversal vulnerability in stash.py pop() that allows attackers to write arbitrary files outside the worktree through intermediate directory symlinks.

CVSS 4.0HIGH 7.3 Local No auth User interaction EPSS 0.00152 Published 2026-10-21 Partial fix · 1.2.8 CWE-22
TI-2026-78710 CVE-2026-114097

Symlink path traversal in Dulwich filter_branch enables file writes

Priority LOW 33

Dulwich from 0.23.1 before 1.2.8 contains a path traversal vulnerability in CommitFilter._apply_index_filter() that allows attackers to write files outside the working directory via symlinks persisting between commits.

CVSS 4.0HIGH 7.3 Local No auth User interaction EPSS 0.00186 Published 2026-10-21 Partial fix · 1.2.8 CWE-22
Open these records in search →