CVE-2026-63395
HighCVSS 8.8Exploitation Probability (EPSS)
Elevated risk54th percentile - higher than 54% of all known CVEs
Summary
In isomorphic-git prior to 1.38.6, git.checkout writes new child paths through symlinked leading directory components without checking them. A malicious repository can first place a directory symlink and later replace the tree state with a child file beneath that path; with Node fs on Linux or macOS the OS can resolve the write outside the working tree, permitting arbitrary host file writes and possible code execution.
Risk Assessment
Arbitrary host file writes and potential code execution are possible when isomorphic-git is used with Node fs on Linux or macOS. Browser and in-memory providers limit impact to their virtual filesystem.
Recommendation
Upgrade isomorphic-git to version 1.38.6 or later. Avoid cloning or pulling untrusted repositories and consider running git operations with restricted write privileges.
Other vulnerabilities in isomorphic-git
See all- CVE-2026-63478Medium
isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git's tree parser in src/models/GitTree.js accepts a standalone .. tree-entry name because it rejects only path separators. During clone or checkout from a malicious or man-in-the-middle-controlled non-GitHub remote, nested .. entries can escape the working-tree root and write files at attacker-selected parent paths on any host-backed fs provider. The arbitrary file write can overwrite startup or configuration files and lead to code execution. GitHub-hosted trees are not a direct source because GitHub rejects .. entries during repository integrity checks. This issue is fixed in version 1.38.6.
- CVE-2026-63476Medium
isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git reads a server-controlled targetSize while applying a packfile delta in src/utils/applyDelta.js and passes it without a bound to Buffer.alloc(targetSize). A malicious or man-in-the-middle-controlled remote can send one delta header that causes git.clone() or git.fetch() to allocate approximately 2 GB before validating the actual delta output. GitPackIndex.fromPack swallows the later size-mismatch error, so a host with sufficient memory may retain the resource waste without a visible failure, while containers, serverless functions, and small virtual machines may terminate. Node.js heap limits do not mitigate the off-heap Buffer allocation. This issue is fixed in version 1.38.6.
- CVE-2026-63475Medium
isomorphic-git before 1.38.6 persists server-supplied circular symref capabilities and resolves the resulting loose symbolic references without a default depth limit or cycle detection. After cloning from a malicious or man-in-the-middle-controlled remote, operations such as log, status, checkout, and branch do not terminate, leaving the repository unusable and causing a persistent denial of service.
- CVE-2026-89011High
isomorphic-git before 1.42.0 contains a prototype pollution vulnerability in the getRemoteInfo function. A malicious Git server operator can pollute Object.prototype by advertising crafted ref names containing '__proto__' path segments during ref negotiation.
Original NVD description (English source)
isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git's git.checkout writes new child paths through symlinked leading directory components without checking them. A malicious repository can first place a directory symlink and later replace the tree state with a child file beneath that path; the usual trigger is a clone followed by a later pull, while a single clone can trigger the issue when a symlink already exists or the consuming application accesses the tree. With Node fs on Linux or macOS, the operating system can resolve the write outside the working tree, permitting arbitrary host file writes and possible code execution. Node fs on Windows usually blocks the symlink plant without additional privilege, and browser or in-memory providers limit impact to their virtual filesystem and are affected only when they implement symlink creation and following. This issue is fixed in version 1.38.6.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS