AIKIDO-2026-496375
dulwich is vulnerable to Incorrect Permission Assignment for Critical Resource
48
Medium Risk
This Affects:
dulwichTL;DR
dulwich.archive.tar_stream copies a Git tree entry's raw file mode directly into the tar header before writing it, so non-canonical bits such as setuid, setgid, and sticky survive into the tar entry rather than being stripped like native git archive does. Since the source tree can come from an untrusted cloned or fetched commit, a crafted tree entry can cause an extracted file to carry elevated permission bits. The fix canonicalizes the mode down to the standard executable/non-executable permission bits before writing the tar header, matching the same canonicalization dulwich already applies during checkout.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you generate tar archives from repository trees that could contain attacker-influenced content.
Background info
dulwich is vulnerable to Incorrect Permission Assignment for Critical Resource in versions 0.0.1 - 1.2.10.
How to fix this
Upgrade the dulwich library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant