CVE-2026-52726

A flaw was found in Dulwich, a pure-Python implementation of Git file formats and protocols. This vulnerability allows a remote attacker to achieve arbitrary code execution by crafting a malicious Git submodule. When a user clones or updates a repository with such a submodule, the attacker-controlled content is written into the victim's Git hooks directory. Subsequent Git or Dulwich commands can then execute these malicious files, leading to system compromise.

Red Hat product security classifies this bug as Important as this bug can be triggered by the victim merely by cloning a maliciours repository. The attacker is however unable to trigger any executable without subsequent actions by the victim. Users should pay attention to any binaries that are cloned over as this is not normal and not clone untrusted repositories.

There is no loss of integrity and confidentiality loss can be minimal depending on the due diligence executed by the user so the CVSS score is rated lower even though this bug is classified as Important.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, users should avoid cloning or updating Git repositories that contain submodules from untrusted or unverified sources. When interacting with repositories, especially those with submodules, ensure the source is trusted to prevent the execution of arbitrary code via crafted Git hooks. If possible, review the .gitmodules file and the submodule's content before performing recursive submodule operations.