---
id: CVE-2026-52726
title: >-
  dulwich: Dulwich: Arbitrary code execution via crafted Git submodules
  (CVE-2026-52726)
summary: >-
  A flaw was found in Dulwich, a pure-Python implementation of Git file formats
  and protocols. This vulnerability allows a remote attacker to achieve
  arbitrary code execution by crafting a malicious Git submodule. When a user
  clones or updat…
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L'
cvssSource: vendor
cwe: CWE-22
vendor: Red Hat
product: Red Hat Enterprise Linux 8
affected:
  - ansible_automation_platform 2
  - enterprise_linux 8
  - openshift_ai_rhoai
patched:
  - dulwich 1.2.5
published: '2026-06-10'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T14:55:01+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52726.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52726.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-52726'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2487769'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-52726'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-52726'
  - url: 'https://github.com/jelmer/dulwich/releases/tag/dulwich-1.2.5'
  - url: 'https://github.com/jelmer/dulwich/security/advisories/GHSA-gfhv-vqv2-4544'
  - url: 'https://github.com/advisories/GHSA-gfhv-vqv2-4544'
tags:
  - csaf
  - vex
  - red-hat
  - ghsa
  - pip
  - score-dispute
epss: 0.0068
epssPercentile: 0.50326
ecosystem: pip
scores:
  vendor: 5.4
  ghsa: 7.5
ingestedAt: '2026-07-02T18:41:45.704Z'
---

## Overview

A flaw was found in Dulwich, a pure-Python implementation of Git file formats and protocols. This vulnerability allows a remote attacker to achieve arbitrary code execution by crafting a malicious Git submodule. When a user clones or updates a repository with such a submodule, the attacker-controlled content is written into the victim's Git hooks directory. Subsequent Git or Dulwich commands can then execute these malicious files, leading to system compromise.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux 8, Red Hat OpenShift AI (RHOAI) · no fix planned: Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux 8, Red Hat OpenShift AI (RHOAI) · updated 2026-09-24 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52726.json)

**dulwich: Dulwich: Arbitrary code execution via crafted Git submodules** — rated Moderate by Red Hat. Released 2026-06-10, updated 2026-09-24.

Affected:

- Red Hat Ansible Automation Platform 2
- Red Hat Enterprise Linux 8
- Red Hat OpenShift AI (RHOAI)

No fix planned:

- Red Hat Ansible Automation Platform 2
- Red Hat Enterprise Linux 8
- Red Hat OpenShift AI (RHOAI)

Not affected:

- Red Hat Ansible Automation Platform 2
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift Container Platform 4
- Red Hat Satellite 6

## Remediation

Will not fix

Workarounds / mitigations:

- To mitigate this issue, users should avoid cloning or updating Git repositories that contain submodules from untrusted or unverified sources. When interacting with repositories, especially those with submodules, ensure the source is trusted to prevent the execution of arbitrary code via crafted Git hooks. If possible, review the `.gitmodules` file and the submodule's content before performing recursive submodule operations.

## Package advisory (CVE-2026-52726)

Affected packages:

- `dulwich >= 0.23.2, < 1.2.5`

Patched in:

- `dulwich 1.2.5`

Source: https://github.com/advisories/GHSA-gfhv-vqv2-4544