{"id":"CVE-2026-52726","title":"dulwich: Dulwich: Arbitrary code execution via crafted Git submodules (CVE-2026-52726)","summary":"A flaw was found in Dulwich, a pure-Python implementation of Git file formats and protocols. This vulnerability allows a remote attacker to achieve arbitrary code execution by crafting a malicious Git submodule. When a user clones or updat…","severity":"medium","cvss":5.4,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","cvssSource":"vendor","cwe":"CWE-22","vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","affected":["ansible_automation_platform 2","enterprise_linux 8","openshift_ai_rhoai"],"patched":["dulwich 1.2.5"],"published":"2026-06-10","updated":"2026-09-24","sourceUpdated":"2026-09-24T14:55:01+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52726.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52726.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-52726"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2487769"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-52726"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-52726"},{"url":"https://github.com/jelmer/dulwich/releases/tag/dulwich-1.2.5"},{"url":"https://github.com/jelmer/dulwich/security/advisories/GHSA-gfhv-vqv2-4544"},{"url":"https://github.com/advisories/GHSA-gfhv-vqv2-4544"}],"tags":["csaf","vex","red-hat","ghsa","pip","score-dispute"],"epss":0.00448,"epssPercentile":0.38802,"ecosystem":"pip","scores":{"vendor":5.4,"ghsa":7.5},"ingestedAt":"2026-07-02T18:41:45.704Z","slug":"CVE-2026-52726","body":"## Overview\n\nA flaw was found in Dulwich, a pure-Python implementation of Git file formats and protocols. This vulnerability allows a remote attacker to achieve arbitrary code execution by crafting a malicious Git submodule. When a user clones or updates a repository with such a submodule, the attacker-controlled content is written into the victim's Git hooks directory. Subsequent Git or Dulwich commands can then execute these malicious files, leading to system compromise.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux 8, Red Hat OpenShift AI (RHOAI) · no fix planned: Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux 8, Red Hat OpenShift AI (RHOAI) · updated 2026-09-24 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52726.json)\n\n**dulwich: Dulwich: Arbitrary code execution via crafted Git submodules** — rated Moderate by Red Hat. Released 2026-06-10, updated 2026-09-24.\n\nAffected:\n\n- Red Hat Ansible Automation Platform 2\n- Red Hat Enterprise Linux 8\n- Red Hat OpenShift AI (RHOAI)\n\nNo fix planned:\n\n- Red Hat Ansible Automation Platform 2\n- Red Hat Enterprise Linux 8\n- Red Hat OpenShift AI (RHOAI)\n\nNot affected:\n\n- Red Hat Ansible Automation Platform 2\n- Red Hat OpenShift AI (RHOAI)\n- Red Hat OpenShift Container Platform 4\n- Red Hat Satellite 6\n\n## Remediation\n\nWill not fix\n\nWorkarounds / mitigations:\n\n- To mitigate this issue, users should avoid cloning or updating Git repositories that contain submodules from untrusted or unverified sources. When interacting with repositories, especially those with submodules, ensure the source is trusted to prevent the execution of arbitrary code via crafted Git hooks. If possible, review the `.gitmodules` file and the submodule's content before performing recursive submodule operations.\n\n## Package advisory (CVE-2026-52726)\n\nAffected packages:\n\n- `dulwich >= 0.23.2, < 1.2.5`\n\nPatched in:\n\n- `dulwich 1.2.5`\n\nSource: https://github.com/advisories/GHSA-gfhv-vqv2-4544","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":29.7,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":210684,"id":"CVE-2026-52726","ts":1790322190867,"field":"cvss","old":"7.5","new":"5.4"},{"seq":210683,"id":"CVE-2026-52726","ts":1790322190867,"field":"severity","old":"high","new":"medium"}]}