CVE-2026-52726
published 2026-06-10CVE-2026-52726: Dulwich is a pure-Python implementation of the Git file formats and protocols. Starting in version 0.23.2 and prior to version 1.2.5…
PriorityP346high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.45%
37.4th percentile
Dulwich is a pure-Python implementation of the Git file formats and protocols. Starting in version 0.23.2 and prior to version 1.2.5, `dulwich.porcelain.submodule_update`, and by extension `porcelain.clone(..., recurse_submodules=True)`, materializes attacker-controlled submodule paths from a crafted upstream repository without path validation. A malicious `.gitmodules` plus a matching tree gitlink whose `path` is `.git/hooks` (or any other directory inside the parent repository's `.git` directory) causes the attacker's submodule tree contents to be written directly into the victim's `.git/hooks/` directory, preserving executable mode bits. The dropped executables are then run by any subsequent `git` or `dulwich` command that invokes the matching hook, resulting in arbitrary code execution. This is the dulwich equivalent of the upstream Git fixes for CVE-2024-32002 / CVE-2024-32004, which were never propagated into dulwich's separately implemented submodule porcelain. Version 1.2.5 patches the issue.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ansible-automation-platform-26 | controller-rhel9 | — | — |
| ansible-automation-platform-26 | eda-controller-rhel9 | — | — |
| ansible-automation-platform-26 | lightspeed-chatbot-rhel9 | — | — |
| ansible-automation-platform-27 | controller-rhel9 | — | — |
| ansible-automation-platform-27 | eda-controller-rhel9 | — | — |
| dulwich_project | dulwich | >= 0.23.2 < 1.2.5 | 1.2.5 |
| rhoai | odh-kserve-autogluon-server-rhel9 | — | — |
| rhoai | odh-kserve-storage-initializer-rhel9 | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
ghsa9.0CRITICAL
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
dulwich: Dulwich: Arbitrary code execution via crafted Git submodules
vendor_redhat·2026-06-10·CVSS 7.5
CVE-2026-52726 [HIGH] CWE-22 dulwich: Dulwich: Arbitrary code execution via crafted Git submodules
dulwich: Dulwich: Arbitrary code execution via crafted Git submodules
A flaw was found in Dulwich, a pure-Python implementation of Git file formats and protocols. This vulnerability allows a remote attacker to achieve arbitrary code execution by crafting a malicious Git submodule. When a user clones or updates a repository with such a submodule, the attacker-controlled content is written into the victim's Git hooks directory. Subsequent Git or Dulwich commands can then execute these malicious files, leading to system compromise.
Statement: Red Hat product security classifies this bug as Important as this bug can be triggered by the victim merely by cloning a maliciours repository. The attacker is however unable to trigger any executable without subsequent actions by the victim. Users sho
GHSA
Dulwich's submodule path traversal in porcelain.submodule_update / porcelain.clone(recurse_submodules=True) yields RCE via attacker-dropped .git/hooks payload
ghsa·2026-07-02·CVSS 9.0
CVE-2026-52726 [CRITICAL] CWE-22 Dulwich's submodule path traversal in porcelain.submodule_update / porcelain.clone(recurse_submodules=True) yields RCE via attacker-dropped .git/hooks payload
Dulwich's submodule path traversal in porcelain.submodule_update / porcelain.clone(recurse_submodules=True) yields RCE via attacker-dropped .git/hooks payload
### Summary
`dulwich.porcelain.submodule_update`, and by extension `porcelain.clone(..., recurse_submodules=True)`, materializes attacker-controlled submodule paths from a crafted upstream repository without path validation. A malicious `.gitmodules` plus a matching tree gitlink whose `path` is `.git/hooks` (or any other directory inside the parent repository's `.git` directory) causes the attacker's submodule tree contents to be written directly into the victim's `.git/hooks/` directory, preserving executable mode bits. The dropped executables are then run by any subsequent `git` or `dulwich` command that invokes the matching hook
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-52726 python-dulwich: Dulwich: Arbitrary code execution via crafted Git submodules [epel-all]
bugzilla·2026-06-18·CVSS 7.5
CVE-2026-52726 [HIGH] CVE-2026-52726 python-dulwich: Dulwich: Arbitrary code execution via crafted Git submodules [epel-all]
CVE-2026-52726 python-dulwich: Dulwich: Arbitrary code execution via crafted Git submodules [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-52726 dulwich: Dulwich: Arbitrary code execution via crafted Git submodules
bugzilla·2026-06-10·CVSS 9.0
CVE-2026-52726 [CRITICAL] CVE-2026-52726 dulwich: Dulwich: Arbitrary code execution via crafted Git submodules
CVE-2026-52726 dulwich: Dulwich: Arbitrary code execution via crafted Git submodules
Dulwich is a pure-Python implementation of the Git file formats and protocols. Starting in version 0.23.2 and prior to version 1.2.5, `dulwich.porcelain.submodule_update`, and by extension `porcelain.clone(..., recurse_submodules=True)`, materializes attacker-controlled submodule paths from a crafted upstream repository without path validation. A malicious `.gitmodules` plus a matching tree gitlink whose `path` is `.git/hooks` (or any other directory inside the parent repository's `.git` directory) causes the attacker's submodule tree contents to be written directly into the victim's `.git/hooks/` directory, preserving executable mode bits. The dropped executables are then run by any subsequent `git` or `
2026-06-10
Published