AIKIDO-2026-232780
dulwich is vulnerable to Path Traversal
50
Medium Risk
This Affects:
dulwichTL;DR
get_path_element_validator selects the checkout path-element check with if protectNTFS / elif protectHFS, so when core.protectNTFS is on (its default everywhere) the HFS check never runs. On macOS, where core.protectHFS also defaults on, an HFS+ spelling of .git built from ignorable code points can pass the NTFS validator, be written on checkout of an untrusted tree, and collapse back to .git on the filesystem. The fix requires every enabled protection to pass so NTFS and HFS checks apply together.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you check out or clone untrusted repositories on macOS (where core.protectHFS defaults on).
Background info
dulwich is vulnerable to Path Traversal in versions 0.10.0 - 1.2.10.
How to fix this
Upgrade the dulwich library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant