{
  "cveId": "CVE-2026-52726",
  "url": "https://patchblox.com/security/cve/CVE-2026-52726",
  "summary": "CVE-2026-52726 is fixed in dulwich on 1 platform by DEBIAN-CVE-2026-52726 (version 1.2.5-1), released June 29, 2026. It is not reported as exploited. Patch Radar priority: High.",
  "title": "dulwich: Dulwich is a pure-Python implementation of the Git file formats and protocols",
  "description": "Dulwich is a pure-Python implementation of the Git file formats and protocols. Starting in version 0.23.2 and prior to version 1.2.5, \u0060dulwich.porcelain.submodule_update\u0060, and by extension \u0060porcelain.clone(..., recurse_submodules=True)\u0060, materializes attacker-controlled submodule paths from a crafted upstream repository without path validation. A malicious \u0060.gitmodules\u0060 plus a matching tree gitlink whose \u0060path\u0060 is \u0060.git/hooks\u0060 (or any other directory inside the parent repository\u0027s \u0060.git\u0060 directory) causes the attacker\u0027s submodule tree contents to be written directly into the victim\u0027s \u0060.git/hooks/\u0060 directory, preserving executable mode bits. The dropped executables are then run by any subsequent \u0060git\u0060 or \u0060dulwich\u0060 command that invokes the matching hook, resulting in arbitrary code execution. This is the dulwich equivalent of the upstream Git fixes for CVE-2024-32002 / CVE-2024-32004, which were never propagated into dulwich\u0027s separately implemented submodule porcelain. Version 1.2.5 patches the issue.",
  "published": "2026-06-10T23:16:50Z",
  "severity": "high",
  "cvss": 7.5,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "epss": 0.00448,
  "epssPercentile": 0.39245,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "dulwich",
      "release": "Debian 14",
      "fixedVersion": "1.2.5-1",
      "fix": "DEBIAN-CVE-2026-52726",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-52726",
      "released": "2026-06-29T14:19:49Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T19:38:12Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}