CVE-2026-52726

Dulwich is a pure-Python implementation of the Git file formats and protocols. Starting in version 0.23.2 and prior to version 1.2.5, `dulwich.porcelain.submodule_update`, and by extension `porcelain.clone(..., recurse_submodules=True)`, materializes attacker-controlled submodule paths from a crafted upstream repository without path validation. A malicious `.gitmodules` plus a matching tree gitlink whose `path` is `.git/hooks` (or any other directory inside the parent repository's `.git` directory) causes the attacker's submodule tree contents to be written directly into the victim's `.git/hooks/` directory, preserving executable mode bits. The dropped executables are then run by any subsequent `git` or `dulwich` command that invokes the matching hook, resulting in arbitrary code execution. This is the dulwich equivalent of the upstream Git fixes for CVE-2024-32002 / CVE-2024-32004, which were never propagated into dulwich's separately implemented submodule porcelain. Version 1.2.5 patches the issue.

• CWE-22

• https://github.com/jelmer/dulwich/releases/tag/dulwich-1.2.5
• https://github.com/jelmer/dulwich/security/advisories/GHSA-gfhv-vqv2-4544
• https://github.com/jelmer/dulwich/security/advisories/GHSA-gfhv-vqv2-4544

Published

Jun 10, 2026

Last Modified

Jul 21, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-52719An out-of-bounds read vulnerability was found in the VA JPEG…7.1
• CVE-2026-5272Heap buffer overflow in GPU in Google Chrome prior to 146.0.…8.8
• CVE-2026-52720A heap buffer overflow vulnerability was found in GStreamer'…8.8
• CVE-2026-52721Multiple out-of-bounds read vulnerabilities were found in GS…5.3
• CVE-2026-52722A signed integer overflow vulnerability was found in GStream…7.1
• CVE-2026-52725Angular is a development platform for building mobile and de…6.1
• CVE-2026-5273Use after free in CSS in Google Chrome prior to 146.0.7680.1…6.3
• CVE-2026-5274Integer overflow in Codecs in Google Chrome prior to 146.0.7…8.8
• CVE-2026-52746JSONata is a JSON query and transformation language. Prior t…7.5
• CVE-2026-52747ModSecurity is an open source, cross platform web applicatio…8.6
• CVE-2026-5275Heap buffer overflow in ANGLE in Google Chrome on Mac prior …8.8
• CVE-2026-52750Ghidra before 12.1 contains a command injection vulnerabilit…8.4