Search

Find a vulnerability

Search criteria

    5 vulnerabilities by isomorphic-git

    CVE-2026-63395 (GCVE-0-2026-63395)

    Vulnerability from cvelistv5 – Published: 2026-11-03 19:48 – Updated: 2026-11-03 21:30
    VLAI
    Title
    isomorphic-git: Arbitrary file write outside the working tree via a directory symlink during checkout (potential RCE)
    Summary
    isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git's git.checkout writes new child paths through symlinked leading directory components without checking them. A malicious repository can first place a directory symlink and later replace the tree state with a child file beneath that path; the usual trigger is a clone followed by a later pull, while a single clone can trigger the issue when a symlink already exists or the consuming application accesses the tree. With Node fs on Linux or macOS, the operating system can resolve the write outside the working tree, permitting arbitrary host file writes and possible code execution. Node fs on Windows usually blocks the symlink plant without additional privilege, and browser or in-memory providers limit impact to their virtual filesystem and are affected only when they implement symlink creation and following. This issue is fixed in version 1.38.6.
    Severity
    8.8 (High)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
    SSVC
    Exploitation: poc Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-11-03 21:29 UTC
    CWE
    • CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
    • CWE-59 - Improper Link Resolution Before File Access ('Link Following')
    Assigner
    GitHub_M CNA
    References
    Impacted products
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-63395",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-03T21:29:42.766185Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-03T21:30:11.615Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/isomorphic-git/isomorphic-git/security/advisories/GHSA-9qw7-j9xw-fv9c"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "isomorphic-git",
          "vendor": "isomorphic-git",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.38.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git\u0027s git.checkout writes new child paths through symlinked leading directory components without checking them. A malicious repository can first place a directory symlink and later replace the tree state with a child file beneath that path; the usual trigger is a clone followed by a later pull, while a single clone can trigger the issue when a symlink already exists or the consuming application accesses the tree. With Node fs on Linux or macOS, the operating system can resolve the write outside the working tree, permitting arbitrary host file writes and possible code execution. Node fs on Windows usually blocks the symlink plant without additional privilege, and browser or in-memory providers limit impact to their virtual filesystem and are affected only when they implement symlink creation and following. This issue is fixed in version 1.38.6."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-59",
              "description": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-03T19:48:11.232Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/isomorphic-git/isomorphic-git/security/advisories/GHSA-9qw7-j9xw-fv9c",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/isomorphic-git/isomorphic-git/security/advisories/GHSA-9qw7-j9xw-fv9c"
        },
        {
          "name": "https://github.com/isomorphic-git/isomorphic-git/pull/2370",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/isomorphic-git/isomorphic-git/pull/2370"
        },
        {
          "name": "https://github.com/isomorphic-git/isomorphic-git/commit/823843d1cd19182df79bc907c767f5bcecb39a0b",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/isomorphic-git/isomorphic-git/commit/823843d1cd19182df79bc907c767f5bcecb39a0b"
        },
        {
          "name": "https://github.com/isomorphic-git/isomorphic-git/releases/tag/v1.38.6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/isomorphic-git/isomorphic-git/releases/tag/v1.38.6"
        }
      ],
      "source": {
        "advisory": "GHSA-9qw7-j9xw-fv9c",
        "discovery": "UNKNOWN"
      },
      "title": "isomorphic-git: Arbitrary file write outside the working tree via a directory symlink during checkout (potential RCE)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-63395",
    "datePublished": "2026-11-03T19:48:11.232Z",
    "dateReserved": "2026-07-16T17:39:30.171Z",
    "dateUpdated": "2026-11-03T21:30:11.615Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-63475 (GCVE-0-2026-63475)

    Vulnerability from cvelistv5 – Published: 2026-11-03 19:45 – Updated: 2026-11-03 21:31
    VLAI
    Title
    isomorphic-git: Circular symbolic references cause non-terminating resolution (DoS)
    Summary
    isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git persists server-supplied circular symref= capabilities through updateRemoteRefs, and GitRefManager.resolve() follows the resulting loose symbolic references without a default depth limit or cycle detection. After a clone from a malicious or man-in-the-middle-controlled remote, operations such as log, status, checkout, and branch that resolve refs/remotes/origin/a or refs/remotes/origin/b do not terminate. The circular references remain on disk, leaving the repository unusable for the application and causing a persistent denial of service. This issue is fixed in version 1.38.6.
    Severity
    4.3 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
    SSVC
    Exploitation: poc Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-11-03 21:30 UTC
    CWE
    • CWE-674 - Uncontrolled Recursion
    • CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')
    Assigner
    GitHub_M CNA
    References
    Impacted products
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-63475",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-03T21:30:35.793171Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-03T21:31:07.998Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/isomorphic-git/isomorphic-git/security/advisories/GHSA-96wc-2m84-2cj7"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "isomorphic-git",
          "vendor": "isomorphic-git",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.38.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git persists server-supplied circular symref= capabilities through updateRemoteRefs, and GitRefManager.resolve() follows the resulting loose symbolic references without a default depth limit or cycle detection. After a clone from a malicious or man-in-the-middle-controlled remote, operations such as log, status, checkout, and branch that resolve refs/remotes/origin/a or refs/remotes/origin/b do not terminate. The circular references remain on disk, leaving the repository unusable for the application and causing a persistent denial of service. This issue is fixed in version 1.38.6."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-674",
              "description": "CWE-674: Uncontrolled Recursion",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-835",
              "description": "CWE-835: Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-03T19:45:24.488Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/isomorphic-git/isomorphic-git/security/advisories/GHSA-96wc-2m84-2cj7",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/isomorphic-git/isomorphic-git/security/advisories/GHSA-96wc-2m84-2cj7"
        },
        {
          "name": "https://github.com/isomorphic-git/isomorphic-git/pull/2370",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/isomorphic-git/isomorphic-git/pull/2370"
        },
        {
          "name": "https://github.com/isomorphic-git/isomorphic-git/commit/823843d1cd19182df79bc907c767f5bcecb39a0b",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/isomorphic-git/isomorphic-git/commit/823843d1cd19182df79bc907c767f5bcecb39a0b"
        },
        {
          "name": "https://github.com/isomorphic-git/isomorphic-git/releases/tag/v1.38.6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/isomorphic-git/isomorphic-git/releases/tag/v1.38.6"
        }
      ],
      "source": {
        "advisory": "GHSA-96wc-2m84-2cj7",
        "discovery": "UNKNOWN"
      },
      "title": "isomorphic-git: Circular symbolic references cause non-terminating resolution (DoS)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-63475",
    "datePublished": "2026-11-03T19:45:24.488Z",
    "dateReserved": "2026-07-16T21:37:45.769Z",
    "dateUpdated": "2026-11-03T21:31:07.998Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-63476 (GCVE-0-2026-63476)

    Vulnerability from cvelistv5 – Published: 2026-11-03 19:44 – Updated: 2026-11-07 03:27
    VLAI
    Title
    isomorphic-git: Unbounded memory allocation from attacker-controlled delta target size (DoS)
    Summary
    isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git reads a server-controlled targetSize while applying a packfile delta in src/utils/applyDelta.js and passes it without a bound to Buffer.alloc(targetSize). A malicious or man-in-the-middle-controlled remote can send one delta header that causes git.clone() or git.fetch() to allocate approximately 2 GB before validating the actual delta output. GitPackIndex.fromPack swallows the later size-mismatch error, so a host with sufficient memory may retain the resource waste without a visible failure, while containers, serverless functions, and small virtual machines may terminate. Node.js heap limits do not mitigate the off-heap Buffer allocation. This issue is fixed in version 1.38.6.
    Severity
    4.3 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
    SSVC
    Exploitation: poc Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-11-07 03:27 UTC
    CWE
    • CWE-400 - Uncontrolled Resource Consumption
    • CWE-789 - Memory Allocation with Excessive Size Value
    Assigner
    GitHub_M CNA
    References
    Impacted products
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-63476",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-07T03:27:18.874587Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-07T03:27:39.077Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/isomorphic-git/isomorphic-git/security/advisories/GHSA-9x82-4j54-863h"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "isomorphic-git",
          "vendor": "isomorphic-git",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.38.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git reads a server-controlled targetSize while applying a packfile delta in src/utils/applyDelta.js and passes it without a bound to Buffer.alloc(targetSize). A malicious or man-in-the-middle-controlled remote can send one delta header that causes git.clone() or git.fetch() to allocate approximately 2 GB before validating the actual delta output. GitPackIndex.fromPack swallows the later size-mismatch error, so a host with sufficient memory may retain the resource waste without a visible failure, while containers, serverless functions, and small virtual machines may terminate. Node.js heap limits do not mitigate the off-heap Buffer allocation. This issue is fixed in version 1.38.6."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-789",
              "description": "CWE-789: Memory Allocation with Excessive Size Value",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-03T19:44:06.908Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/isomorphic-git/isomorphic-git/security/advisories/GHSA-9x82-4j54-863h",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/isomorphic-git/isomorphic-git/security/advisories/GHSA-9x82-4j54-863h"
        },
        {
          "name": "https://github.com/isomorphic-git/isomorphic-git/pull/2370",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/isomorphic-git/isomorphic-git/pull/2370"
        },
        {
          "name": "https://github.com/isomorphic-git/isomorphic-git/commit/823843d1cd19182df79bc907c767f5bcecb39a0b",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/isomorphic-git/isomorphic-git/commit/823843d1cd19182df79bc907c767f5bcecb39a0b"
        },
        {
          "name": "https://github.com/isomorphic-git/isomorphic-git/releases/tag/v1.38.6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/isomorphic-git/isomorphic-git/releases/tag/v1.38.6"
        }
      ],
      "source": {
        "advisory": "GHSA-9x82-4j54-863h",
        "discovery": "UNKNOWN"
      },
      "title": "isomorphic-git: Unbounded memory allocation from attacker-controlled delta target size (DoS)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-63476",
    "datePublished": "2026-11-03T19:44:06.908Z",
    "dateReserved": "2026-07-16T21:37:45.769Z",
    "dateUpdated": "2026-11-07T03:27:39.077Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-63478 (GCVE-0-2026-63478)

    Vulnerability from cvelistv5 – Published: 2026-11-03 19:39 – Updated: 2026-11-07 03:26
    VLAI
    Title
    isomorphic-git: Path traversal via a ".." tree-entry name writes files outside the working directory on clone/checkout
    Summary
    isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git's tree parser in src/models/GitTree.js accepts a standalone .. tree-entry name because it rejects only path separators. During clone or checkout from a malicious or man-in-the-middle-controlled non-GitHub remote, nested .. entries can escape the working-tree root and write files at attacker-selected parent paths on any host-backed fs provider. The arbitrary file write can overwrite startup or configuration files and lead to code execution. GitHub-hosted trees are not a direct source because GitHub rejects .. entries during repository integrity checks. This issue is fixed in version 1.38.6.
    Severity
    5.3 (Medium)
    CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
    SSVC
    Exploitation: poc Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-11-07 03:26 UTC
    CWE
    • CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
    Assigner
    GitHub_M CNA
    References
    Impacted products
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-63478",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-07T03:26:31.010275Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-07T03:26:53.194Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/isomorphic-git/isomorphic-git/security/advisories/GHSA-cw2g-2vwq-88w6"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "isomorphic-git",
          "vendor": "isomorphic-git",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.38.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git\u0027s tree parser in src/models/GitTree.js accepts a standalone .. tree-entry name because it rejects only path separators. During clone or checkout from a malicious or man-in-the-middle-controlled non-GitHub remote, nested .. entries can escape the working-tree root and write files at attacker-selected parent paths on any host-backed fs provider. The arbitrary file write can overwrite startup or configuration files and lead to code execution. GitHub-hosted trees are not a direct source because GitHub rejects .. entries during repository integrity checks. This issue is fixed in version 1.38.6."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-03T19:39:52.188Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/isomorphic-git/isomorphic-git/security/advisories/GHSA-cw2g-2vwq-88w6",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/isomorphic-git/isomorphic-git/security/advisories/GHSA-cw2g-2vwq-88w6"
        },
        {
          "name": "https://github.com/isomorphic-git/isomorphic-git/pull/2370",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/isomorphic-git/isomorphic-git/pull/2370"
        },
        {
          "name": "https://github.com/isomorphic-git/isomorphic-git/commit/823843d1cd19182df79bc907c767f5bcecb39a0b",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/isomorphic-git/isomorphic-git/commit/823843d1cd19182df79bc907c767f5bcecb39a0b"
        },
        {
          "name": "https://github.com/isomorphic-git/isomorphic-git/releases/tag/v1.38.6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/isomorphic-git/isomorphic-git/releases/tag/v1.38.6"
        }
      ],
      "source": {
        "advisory": "GHSA-cw2g-2vwq-88w6",
        "discovery": "UNKNOWN"
      },
      "title": "isomorphic-git: Path traversal via a \"..\" tree-entry name writes files outside the working directory on clone/checkout"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-63478",
    "datePublished": "2026-11-03T19:39:52.188Z",
    "dateReserved": "2026-07-16T21:37:45.769Z",
    "dateUpdated": "2026-11-07T03:26:53.194Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-89011 (GCVE-0-2026-89011)

    Vulnerability from cvelistv5 – Published: 2026-09-10 19:56 – Updated: 2026-11-08 14:09 X_Open Source
    VLAI
    Title
    isomorphic-git < 1.42.0 Prototype Pollution via getRemoteInfo
    Summary
    isomorphic-git before 1.42.0 contains a prototype pollution vulnerability in the getRemoteInfo function that allows a malicious Git server operator to pollute Object.prototype by advertising crafted ref names containing '__proto__' path segments during ref negotiation. Attackers controlling a Git server can advertise a specially crafted ref such as '__proto__/corsProxy' to reroute all subsequent network operations through an attacker-controlled proxy, causing isomorphic-git to invoke the victim's onAuth callback and transmit credentials to the attacker when the victim calls getRemoteInfo with an attacker-supplied URL.
    Severity
    7.1 (High)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
    7.1 (High)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
    SSVC
    Exploitation: none Automatable: yes Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-09-11 17:09 UTC
    CWE
    • CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
    Assigner
    VulnCheck CNA
    References
    Impacted products
    Vendor Product Version
    isomorphic-git isomorphic-git Affected: 0 , < 1.42.0 (semver)
    		Create a notification for this product.
    Date Public
    2026-09-10 00:00
    Credits
    Isabel Mill VulnCheck
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-89011",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-11T17:09:25.363378Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-11T20:32:36.479Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/isomorphic-git/isomorphic-git",
          "product": "isomorphic-git",
          "repo": "https://github.com/isomorphic-git/isomorphic-git",
          "vendor": "isomorphic-git",
          "versions": [
            {
              "lessThan": "1.42.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Isabel Mill"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulnCheck"
        }
      ],
      "datePublic": "2026-09-10T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "isomorphic-git before 1.42.0 contains a prototype pollution vulnerability in the getRemoteInfo function that allows a malicious Git server operator to pollute Object.prototype by advertising crafted ref names containing \u0027__proto__\u0027 path segments during ref negotiation. Attackers controlling a Git server can advertise a specially crafted ref such as \u0027__proto__/corsProxy\u0027 to reroute all subsequent network operations through an attacker-controlled proxy, causing isomorphic-git to invoke the victim\u0027s onAuth callback and transmit credentials to the attacker when the victim calls getRemoteInfo with an attacker-supplied URL."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1321",
              "description": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-08T14:09:19.711Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-83vg-jxvh-fx76)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/isomorphic-git/isomorphic-git/security/advisories/GHSA-83vg-jxvh-fx76"
        },
        {
          "name": "isomorphic-git 1.42.0 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/isomorphic-git/isomorphic-git/releases/tag/v1.42.0"
        },
        {
          "name": "Pull Request",
          "tags": [
            "issue-tracking",
            "patch"
          ],
          "url": "https://github.com/isomorphic-git/isomorphic-git/pull/2426"
        },
        {
          "name": "Patch Commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/isomorphic-git/isomorphic-git/commit/b3db111885230bac9a648e0a2312c65ca66f76eb"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/isomorphic-git-prototype-pollution-via-getremoteinfo"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "tags": [
        "x_open-source"
      ],
      "title": "isomorphic-git \u003c 1.42.0 Prototype Pollution via getRemoteInfo",
      "x_generator": {
        "engine": "vulncheck"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-89011",
    "datePublished": "2026-09-10T19:56:25.335Z",
    "dateReserved": "2026-09-10T16:23:54.470Z",
    "dateUpdated": "2026-11-08T14:09:19.711Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}