GHSA-cm62-gvxx-vmxx: Dulwich: Symlink directory traversal in stash pop allows arbitrary file write via intermediate directory symlinks

October 2, 2026

Dulwich’s stash.py:pop() function is vulnerable to symlink directory traversal, allowing an attacker to write arbitrary files outside the repository worktree when a victim pops a stash in a malicious repository.

References

github.com/advisories/GHSA-cm62-gvxx-vmxx
github.com/jelmer/dulwich/commit/40a542cb02f9ac39a9eeac1193472903098698f9
github.com/jelmer/dulwich/releases/tag/dulwich-1.2.8
github.com/jelmer/dulwich/security/advisories/GHSA-cm62-gvxx-vmxx

Code Behaviors & Features

Detect and mitigate GHSA-cm62-gvxx-vmxx with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →