AIKIDO-2026-813214

TL;DR

Dulwich's path-restricted porcelain.checkout(paths=...) writes files with a raw os.open(file_path, O_WRONLY|O_CREAT|O_TRUNC, mode) call that bypasses build_file_from_blob and follows symlinks at both the target file and intermediate directories. A crafted repository can leave a symlink at a checkout target so that restoring a specific path writes attacker-controlled content, with attacker-controlled mode bits, outside the work tree such as into .git/hooks. Planting an executable hook this way leads to remote code execution on the next checkout. The fix routes these writes through build_file_from_blob, which replaces an existing symlink with a fresh regular file instead of writing through it.