GHSA-cm62-gvxx-vmxx: Dulwich: Symlink directory traversal in stash pop allows arbitrary file write via intermediate directory symlinks

October 2, 2026

Dulwich’s stash.py:pop() function is vulnerable to symlink directory traversal, allowing an attacker to write arbitrary files outside the repository worktree when a victim pops a stash in a malicious repository.

References

github.com/advisories/GHSA-cm62-gvxx-vmxx
github.com/jelmer/dulwich/commit/40a542cb02f9ac39a9eeac1193472903098698f9
github.com/jelmer/dulwich/releases/tag/dulwich-1.2.8
github.com/jelmer/dulwich/security/advisories/GHSA-cm62-gvxx-vmxx

Code Behaviors & Features

Detect and mitigate GHSA-cm62-gvxx-vmxx with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →