Command Injection in Dulwich ProcessMergeDriver %P Placeholder

Dulwich, a pure-Python implementation of Git file formats and protocols, is vulnerable to command injection in ProcessMergeDriver starting in version 0.24.0 and before version 1.2.5. The vulnerable logic substitutes a file path derived from the Git tree into a merge driver command via the %P placeholder and then executes the resulting command using subprocess.run(..., shell=True). Because the file path can be attacker-controlled through a malicious branch, an attacker can craft a pathname containing shell metacharacters and cause arbitrary shell commands to be executed when the victim performs a merge that invokes a configured merge driver referencing %P. Version 1.2.5 fixes the issue by shell-quoting substituted values.