CVE-2026-52726 Dulwich's submodule path traversal in porcelain.submodule_update / porcelain.clone(recurse_submodules=True) yields RCE via attacker-dropped .git/hooks payload

Dulwich is a pure-Python implementation of the Git file formats and protocols. Starting in version 0.23.2 and prior to version 1.2.5, dulwich.porcelain.submoduleupdate, and by extension porcelain.clone..., recursesubmodules=True, materializes attacker-controlled submodule paths from a crafted...

kyber-k8s (>=0.0.0 <=0.8.0rc2) potentially affected by CVE-2017-16228 via dulwich (=0.16.3)

dulwich PYPI version =0.16.3 is affected by a known vulnerability. The following packages have a transitive dependency on dulwich and may be impacted: - kyber-k8s =0.0.0, =0.8.0rc2 Source cves: CVE-2017-16228 Source advisory: OSV:GHSA-CWWH-4382-6FWR...