Detections
Analytics

Echo: dulwich: security update to 1.2.5

low Tenable Self-Hosted Container Security Plugin ID 461925

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Dulwich is a pure-Python implementation of the Git file formats and protocols. Starting in version 0.24.0
 and prior to version 1.2.5, dulwich.porcelain.format_patch(outdir=...) derives each patch filename from
 the commit's subject line. Prior to this fix, get_summary only replaced spaces with dashes - path
 separators (/, \), parent-directory components (..), and other filename-hostile characters (e.g. :) were
 preserved verbatim and passed straight into os.path.join(outdir, f"{i:04d}-{summary}.patch"). A malicious
 commit subject could therefore direct the generated patch file outside the requested outdir. This is fixed
 in Dulwich 1.2.5. Users should upgrade to 1.2.5 or later. dulwich.patch.get_summary now mirrors git's
 format_sanitized_subject: only `[A-Za-z0-9._]` are kept, runs of other characters collapse to a single -,
 consecutive . collapse to a single ., trailing ./- are stripped, and the result is length-limited. This
 makes the returned string safe to embed as a filename component, so format_patch can no longer be steered
 out of outdir via the commit subject. Until upgrading, callers that pass untrusted commits to
 porcelain.format_patch can use stdout=True and write the patch to a destination they control, rather than
 letting format_patch choose the filename; validate the chosen path before opening - e.g. compare
 os.path.realpath(returned_path) against os.path.realpath(outdir) and reject any patch whose resolved path
 is not inside outdir; and/or pre-screen commits and refuse to format any whose subject's first line
 contains /, \, .., or other characters that are not safe on the target filesystem. (CVE-2026-47712)

Solution

Update the dulwich library and its related packages to version 1.2.5 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-47712

Plugin Details

Severity: Low

ID: 461925

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/3/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 1.2

Percentile: 0.01

CVSS v2

Risk Factor: Low

Base Score: 2.1

Temporal Score: 1.6

Vector: CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:N

CVSS Score Source: CVE-2026-47712

CVSS v3

Risk Factor: Low

Base Score: 3.3

Temporal Score: 2.9

Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 7/1/2026

Vulnerability Publication Date: 6/8/2026

Reference Information

CVE: CVE-2026-47712