The flaw is a command injection vulnerability in Dulwich’s ProcessMergeDriver. The merge driver substitutes a file path from the repository into a command string with a %P placeholder and runs it via subprocess.run with shell=True. By creating a branch that contains malicious file names, an attacker can influence a merge operation and trigger arbitrary code execution on the host performing the merge.

Jelmer Dulwich, versions 0.24.0 through 1.2.4 inclusive. The fix is present in version 1.2.5 and later.

The CVSS v3 score of 7.7 indicates a high severity. Exploitation requires only that an attacker can cause the application to merge a malicious branch; no additional credentials or privileges are needed. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, but the lack of those metrics does not mitigate the risk. Successful exploitation results in remote code execution on the system that performs the merge.