{"items":[{"id":"NVI-00012917","kind":"vulnerability","title":"Dulwich: Symlink write-through in checkout(paths=[]) via raw os.open bypasses all symlink protections","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-8w8g-wq8h-fq33"],"plain_summary":"GitHub lists this reviewed advisory for dulwich. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-0993f123929fb18c814690699b4fa5ee"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-02T18:53:36.000Z","value":"8.6 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-0993f123929fb18c814690699b4fa5ee"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-0993f123929fb18c814690699b4fa5ee","url":"https://github.com/advisories/GHSA-8w8g-wq8h-fq33","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-8w8g-wq8h-fq33","publisher":"GitHub Advisory Database","observed_at":"2026-11-01T01:40:00.567Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-0993f123929fb18c814690699b4fa5ee"],"technology":"dulwich","known_exclusions":[],"conditions_summary":"## Summary\n\nDulwich's `porcelain.checkout(paths=[...])` code path writes files using raw `os.open(file_path, O_WRONLY|O_CREAT|O_TRUNC, mode)` followed by `f.write(obj.data)`. This code path does NOT call `build_file_from_blob()` at all, completely bypassing any symlink protections (including the unreleased d09f8af fix). `os.open` without `O_NOFOLLOW` follows symlinks at both the target file and intermediate directories, allowing arbitrary file writes.\n\n## Root Cause\n\nAt `dulwich/porcelain/__init__.py:5661-5675`, the `checkout(paths=[...])` implementation:\n\n```python\nfile_path = _checked_worktree_path(r, path)\nos.makedirs(os.path.dirname(file_path), exist_ok=True)\nflags = os.O_WRONLY | os.O_CREAT | os.O_TRUNC\nwith os.fdopen(os.open(file_path, flags, mode), \"wb\") as f:\n    f.write(obj.data)\n```\n\n`_checked_worktree_path()` (line 601-631) only performs name validation — checking that the path doesn't start with `/` or `\\\\` and that components pass `INVALID_DOTNAMES` checks. It performs zero filesystem symlink detection.\n\n## Impact\n\nAn attacker can craft a malicious repository that, when a victim clones it and runs `checkout(paths=[...])`, writes attacker-controlled content (with attack","public_affected_ranges":[">= 0.24.0, <= 1.2.7"]}],"null_published_at":"2026-11-01T07:29:12.902Z","source_updated_at":"2026-10-02T18:53:36.000Z","source_disclosed_at":"2026-10-02T18:53:35.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-01T01:40:00.567Z"}],"next_cursor":null,"snapshot_revision":"42594"}