CVE-2026-52726 Overview
CVE-2026-52726 is a path traversal vulnerability [CWE-22] in Dulwich, a pure-Python implementation of the Git file formats and protocols. The flaw affects dulwich.porcelain.submodule_update and porcelain.clone(..., recurse_submodules=True) in versions 0.23.2 through 1.2.4. A crafted upstream repository can place attacker-controlled files inside the victim's .git/hooks directory by abusing unvalidated submodule paths. Any subsequent git or dulwich command that triggers a matching hook executes the planted binary. This is the Dulwich equivalent of the upstream Git issues tracked as CVE-2024-32002 and CVE-2024-32004, whose fixes were never propagated into Dulwich's separately implemented submodule porcelain.
Critical Impact
A malicious remote repository can drop executable hook scripts into a victim's local .git/hooks/ directory during clone, leading to arbitrary code execution on the developer's workstation or CI runner.
Affected Products
- Dulwich versions 0.23.2 through 1.2.4
- Any application invoking dulwich.porcelain.submodule_update
- Any application invoking dulwich.porcelain.clone with recurse_submodules=True
Discovery Timeline
- 2026-06-10 - CVE-2026-52726 published to NVD
- 2026-06-10 - Last updated in NVD database
- Patch Release - Dulwich 1.2.5 released with the fix
Technical Details for CVE-2026-52726
Vulnerability Analysis
The vulnerability resides in Dulwich's submodule porcelain, which materializes submodules onto disk based on metadata supplied by the remote repository. The submodule update routine reads the path field from the .gitmodules file and the matching gitlink entry in the repository tree, then writes the submodule's tree contents to that path on the local filesystem. Dulwich does not validate that the resolved path remains inside the working tree.
When the attacker-controlled path is set to .git/hooks or another directory beneath the parent repository's .git directory, Dulwich writes the submodule's blobs directly into that location. Executable mode bits stored in the tree are preserved on disk. A planted file named post-checkout, post-merge, or similar becomes an active Git hook.
Root Cause
The root cause is missing path canonicalization and containment checks in the submodule materialization logic. Dulwich treats the submodule path field as a trusted relative path rather than untrusted attacker input. The implementation also fails to refuse paths that traverse into .git, which Git itself blocks after the CVE-2024-32002 hardening.
Attack Vector
An attacker publishes or controls a repository that a victim clones with submodule recursion enabled. The malicious .gitmodules declares a submodule whose path value targets .git/hooks. The submodule's tree contains files such as post-checkout with executable mode bits set and arbitrary payload contents. When the victim runs dulwich clone --recurse-submodules or calls porcelain.clone(..., recurse_submodules=True), the payloads land in .git/hooks/. The next Git or Dulwich operation that fires the corresponding hook executes the attacker's code under the victim's user account. The vulnerability is reachable over the network with no authentication and no user interaction beyond the clone itself.
No verified proof-of-concept code is published in the referenced advisory. See the GitHub Security Advisory GHSA-gfhv-vqv2-4544 for vendor technical details.
Detection Methods for CVE-2026-52726
Indicators of Compromise
- Files written to .git/hooks/ immediately following a clone or submodule update operation initiated by Dulwich.
- .gitmodules entries whose path value contains .git, .., or absolute path separators.
- Unexpected executable files named post-checkout, post-merge, pre-commit, or post-update inside cloned repositories on developer or CI hosts.
Detection Strategies
- Inventory Python environments for installed Dulwich versions below 1.2.5 using pip show dulwich or SBOM tooling.
- Audit application code for calls to dulwich.porcelain.clone with recurse_submodules=True and dulwich.porcelain.submodule_update.
- Scan repositories pulled by build systems for .gitmodules files that declare submodule paths referencing .git or parent directories.
Monitoring Recommendations
- Alert on process creations spawned by Git hook scripts on CI runners and developer endpoints where hooks are not expected.
- Monitor filesystem writes targeting .git/hooks/ paths during clone operations performed by Python processes.
- Forward Python application and CI build logs to a centralized analytics platform to correlate Dulwich clone events with subsequent suspicious child processes.
How to Mitigate CVE-2026-52726
Immediate Actions Required
- Upgrade Dulwich to version 1.2.5 or later in every Python environment that performs Git operations.
- Disable recurse_submodules=True in dulwich.porcelain.clone calls until the upgrade is deployed.
- Quarantine any repositories cloned from untrusted sources with vulnerable Dulwich versions and inspect their .git/hooks directories.
Patch Information
The maintainers released Dulwich 1.2.5, which adds path validation to the submodule porcelain and rejects submodule paths that escape the working tree. Install the fixed version with pip install --upgrade dulwich>=1.2.5. Release notes are available at the GitHub Dulwich Release 1.2.5 page.
Workarounds
- Avoid cloning untrusted repositories with Dulwich until version 1.2.5 is installed.
- Pre-validate .gitmodules files in untrusted repositories and reject any submodule path that contains .git segments or directory traversal sequences.
- Run Dulwich-based tooling inside ephemeral, unprivileged containers so any planted hooks execute in a disposable environment.
# Configuration example: pin a safe Dulwich version
pip install 'dulwich>=1.2.5'
# Verify installed version
python -c "import dulwich; print(dulwich.__version__)"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
