CVE-2026-52726

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-52726
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-52726.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-52726
Aliases
Downstream
Published
2026-06-10T22:13:33.320Z
Modified
2026-07-23T03:56:12.392430024Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Dulwich's submodule path traversal in porcelain.submodule_update / porcelain.clone(recurse_submodules=True) yields RCE via attacker-dropped .git/hooks payload
Details

Dulwich is a pure-Python implementation of the Git file formats and protocols. Starting in version 0.23.2 and prior to version 1.2.5, dulwich.porcelain.submodule_update, and by extension porcelain.clone(..., recurse_submodules=True), materializes attacker-controlled submodule paths from a crafted upstream repository without path validation. A malicious .gitmodules plus a matching tree gitlink whose path is .git/hooks (or any other directory inside the parent repository's .git directory) causes the attacker's submodule tree contents to be written directly into the victim's .git/hooks/ directory, preserving executable mode bits. The dropped executables are then run by any subsequent git or dulwich command that invokes the matching hook, resulting in arbitrary code execution. This is the dulwich equivalent of the upstream Git fixes for CVE-2024-32002 / CVE-2024-32004, which were never propagated into dulwich's separately implemented submodule porcelain. Version 1.2.5 patches the issue.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/52xxx/CVE-2026-52726.json",
    "cwe_ids": [
        "CWE-22"
    ],
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/jelmer/dulwich

Affected ranges

Type
GIT
Repo
https://github.com/jelmer/dulwich
Events
Introduced
95cb5d742fd59fd4cc663a7842f7b0198acab922
Fixed
073f4dfa9840af2da59887ed828b026b609faa6c
Database specific 
{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0.23.2"
        },
        {
            "fixed": "1.2.5"
        }
    ]
}

Affected versions

dulwich-0.*
dulwich-0.23.2
dulwich-0.24.0
dulwich-0.24.1
dulwich-0.24.2
dulwich-0.24.5
dulwich-0.24.6
dulwich-0.24.7
dulwich-0.24.8
dulwich-0.25.0
dulwich-0.25.1
dulwich-0.25.2
dulwich-1.*
dulwich-1.0.0
dulwich-1.1.0
dulwich-1.2.0
dulwich-1.2.1
dulwich-1.2.2
dulwich-1.2.3
dulwich-1.2.4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-52726.json"